Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-0636 (GCVE-0-2026-0636)
Vulnerability from cvelistv5 – Published: 2026-04-15 08:59 – Updated: 2026-09-09 12:05
VLAI
EPSS
VEX
Title
LDAP Injection Vulnerability in LDAPStoreHelper.java
Summary
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).
This vulnerability is associated with program files LDAPStoreHelper.
This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 13:12 UTC
CWE
Assigner
References
28 references
Impacted products
56 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Legion of the Bouncy Castle Inc. | BC-JAVA |
Affected:
1.74 , < 1.80.2
(maven)
Affected: 1.81 , < 1.81.1 (maven) Affected: 1.82 , < 1.84 (maven) |
guessed | |
| Red Hat | Red Hat AMQ Broker 7.12.7 |
cpe:/a:redhat:amq_broker:7.12
|
||
| Red Hat | Red Hat AMQ Broker 7.13.5 |
cpe:/a:redhat:amq_broker:7.13
|
||
| Red Hat | Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 |
cpe:/a:redhat:apache_camel_quarkus:3.27
|
||
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 |
Unaffected:
debug-jdk15on , < *
(rpm)
cpe:/a:redhat:apache_camel_spring_boot:4.18 |
||
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 |
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
||
| Red Hat | Red Hat build of Quarkus 3.20.6.SP1 |
cpe:/a:redhat:quarkus:3.20::el8
|
||
| Red Hat | Red Hat build of Quarkus 3.27.3.SP1 |
cpe:/a:redhat:quarkus:3.27::el8
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.25 |
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.16.0-22.redhat_00057.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.3.14-11.SP11_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.5.26-2.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.18.8-1.redhat_00003.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:5.0.31-3.SP2_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.10.0-46.Final_redhat_00044.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:4.1.135-1.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-30.SP12_redhat_00020.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-24.SP12_redhat_00016.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.2.40-2.SP3_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:7.4.25-2.GA_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 |
Unaffected:
ext-jdk15on , < *
(rpm)
Unaffected: ext-jdk18on , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 |
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 |
Unaffected:
0:1.84.0-1.redhat_00001.1.el8eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 |
Unaffected:
0:1.84.0-1.redhat_00001.1.el9eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.12 |
Unaffected:
1786628667 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.12::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.13 |
Unaffected:
1786628681 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.13::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.14 |
Unaffected:
1786533561 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.14::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.15 |
Unaffected:
1786533565 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.15::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.16 |
Unaffected:
1787125166 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.16::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.17 |
Unaffected:
1787124635 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.17::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.18 |
Unaffected:
1787125069 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.18::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.19 |
Unaffected:
1787124632 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.19::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.20 |
Unaffected:
1787124925 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.20::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.21 |
Unaffected:
1787125311 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.21::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.22 |
Unaffected:
1787124779 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.22::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1779528224 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1779359423 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4
|
||
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools
|
||
| Red Hat | Red Hat AMQ Broker 7 |
cpe:/a:redhat:amq_broker:7
|
||
| Red Hat | Red Hat AMQ Clients |
cpe:/a:redhat:amq_clients:2023
|
||
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 |
cpe:/a:redhat:camel_quarkus:3
|
||
| Red Hat | Red Hat build of Apicurio Registry 3 |
cpe:/a:redhat:apicurio_registry:3
|
||
| Red Hat | Red Hat build of Debezium 3 |
cpe:/a:redhat:debezium:3
|
||
| Red Hat | Red Hat Data Grid 8 |
cpe:/a:redhat:jboss_data_grid:8
|
||
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
||
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
||
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 |
cpe:/a:redhat:jboss_enterprise_application_platform:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
||
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai
|
||
| Red Hat | Red Hat Process Automation 7 |
cpe:/a:redhat:jboss_enterprise_bpms_platform:7
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
||
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
||
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0636",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T13:12:14.838595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T13:12:22.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7.12"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat AMQ Broker 7.12.7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7.13"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat AMQ Broker 7.13.5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_quarkus:3.27"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat Build of Apache Camel 4.14 for Quarkus 3.27",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "affected",
"packageName": "bcprov",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "debug-jdk15on",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-lts8on",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.20::el8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Quarkus 3.20.6.SP1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.27::el8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Quarkus 3.27.3.SP1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"defaultStatus": "unaffected",
"product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-activemq-artemis",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-glassfish-jsf",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-ironjacamar",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-annotations",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-core",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-databind",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-jaxrs-providers",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-base",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-java8",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-remoting",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-server-migration",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty-transport-native-epoll",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-bindings",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-federation",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-undertow",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-wildfly",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "bcprov",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "ext-jdk15on",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "ext-jdk18on",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk12",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
],
"defaultStatus": "affected",
"packageName": "eap8-bouncycastle",
"product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.84.0-1.redhat_00001.1.el8eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "eap8-bouncycastle",
"product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.84.0-1.redhat_00001.1.el9eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628667",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.13::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628681",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.14::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533561",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.15::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533565",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125166",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124635",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125069",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124632",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124925",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125311",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124779",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/openvsx-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779528224",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/pluginregistry-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779359423",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "jenkins",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "jenkins-2-plugins",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-lts8on",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "bcprov-ext-jdk15on",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "bcprov-lts8on",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "pki-core:10.6/resteasy",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "pki-deps:10.6/resteasy",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "jmc",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "resteasy",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-debug-jdk18on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-ext-jdk15on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-ext-jdk18on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk16",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk12",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-ext-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-ext-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk12",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on-1.83.0.redhat-00001.jar",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-modelmesh-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-modelmesh-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite:el8/candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-15T08:59:12.677Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-90",
"description": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T12:05:08.413Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"name": "RHBZ#2458641",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18054"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18055"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14276"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13631"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21772"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11720"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11721"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
},
{
"lang": "en",
"value": "RHSA-2026:18054: Red Hat JBoss EAP 8.1 for RHEL 8"
},
{
"lang": "en",
"value": "RHSA-2026:18055: Red Hat JBoss EAP 8.1 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:60247: OpenShift Developer Tools and Services 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:60249: OpenShift Developer Tools and Services 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:60248: OpenShift Developer Tools and Services 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:60239: OpenShift Developer Tools and Services 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:60251: OpenShift Developer Tools and Services 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:60246: OpenShift Developer Tools and Services 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:60250: OpenShift Developer Tools and Services 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:60252: OpenShift Developer Tools and Services 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:60259: OpenShift Developer Tools and Services 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:60254: OpenShift Developer Tools and Services 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:60256: OpenShift Developer Tools and Services 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:14276: Red Hat AMQ Broker 7.12.7"
},
{
"lang": "en",
"value": "RHSA-2026:14272: Red Hat AMQ Broker 7.13.5"
},
{
"lang": "en",
"value": "RHSA-2026:13631: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27"
},
{
"lang": "en",
"value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
},
{
"lang": "en",
"value": "RHSA-2026:18059: Red Hat JBoss Enterprise Application Platform 8.1"
},
{
"lang": "en",
"value": "RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28"
},
{
"lang": "en",
"value": "RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
},
{
"lang": "en",
"value": "RHSA-2026:11720: Red Hat build of Quarkus 3.20.6.SP1"
},
{
"lang": "en",
"value": "RHSA-2026:11721: Red Hat build of Quarkus 3.27.3.SP1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-15T10:01:32.911Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-15T08:59:12.677Z",
"value": "Made public."
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
"defaultStatus": "unaffected",
"modules": [
"prov"
],
"packageName": "bcprov",
"platforms": [
"all"
],
"product": "BC-JAVA",
"programFiles": [
"LDAPStoreHelper"
],
"repo": "https://github.com/bcgit/bc-java",
"vendor": "Legion of the Bouncy Castle Inc.",
"versions": [
{
"lessThan": "1.80.2",
"status": "affected",
"version": "1.74",
"versionType": "maven"
},
{
"lessThan": "1.81.1",
"status": "affected",
"version": "1.81",
"versionType": "maven"
},
{
"lessThan": "1.84",
"status": "affected",
"version": "1.82",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Prasanth Sundararajan (prasanth.srihari@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\u003cp\u003e This vulnerability is associated with program files LDAPStoreHelper.\u003c/p\u003e\u003cp\u003eThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\u003c/p\u003e"
}
],
"value": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\n\n This vulnerability is associated with program files LDAPStoreHelper.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "AUTOMATIC",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-90",
"description": "CWE-90 Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T23:20:07.728Z",
"orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"shortName": "bcorg"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "LDAP Injection Vulnerability in LDAPStoreHelper.java",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"assignerShortName": "bcorg",
"cveId": "CVE-2026-0636",
"datePublished": "2026-04-15T08:59:12.677Z",
"dateReserved": "2026-01-06T03:18:21.572Z",
"dateUpdated": "2026-09-09T12:05:08.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-0636",
"date": "2026-09-10",
"epss": "0.00527",
"percentile": "0.42983"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-0636\",\"sourceIdentifier\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"published\":\"2026-04-15T10:16:38.413\",\"lastModified\":\"2026-09-09T13:18:31.397\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\\n\\n This vulnerability is associated with program files LDAPStoreHelper.\\n\\n\\n\\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\"}],\"affected\":[{\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"affectedData\":[{\"vendor\":\"Legion of the Bouncy Castle Inc.\",\"product\":\"BC-JAVA\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://www.bouncycastle.org/download/bouncy-castle-java/\",\"packageName\":\"bcprov\",\"modules\":[\"prov\"],\"platforms\":[\"all\"],\"programFiles\":[\"LDAPStoreHelper\"],\"repo\":\"https://github.com/bcgit/bc-java\",\"versions\":[{\"version\":\"1.74\",\"lessThan\":\"1.80.2\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"1.81\",\"lessThan\":\"1.81.1\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"1.82\",\"lessThan\":\"1.84\",\"versionType\":\"maven\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7.12.7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7.12\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7.13.5\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7.13\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Apache Camel 4.14 for Quarkus 3.27\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_quarkus:3.27\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"],\"versions\":[{\"version\":\"debug-jdk15on\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-lts8on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus 3.20.6.SP1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:quarkus:3.20::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus 3.27.3.SP1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:quarkus:3.27::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4.25\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-activemq-artemis\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.16.0-22.redhat_00057.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-glassfish-jsf\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.3.14-11.SP11_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-ironjacamar\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.5.26-2.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-annotations\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-core\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-databind\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-jaxrs-providers\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-base\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-java8\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-remoting\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:5.0.31-3.SP2_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-server-migration\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.10.0-46.Final_redhat_00044.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty-transport-native-epoll\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-bindings\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-30.SP12_redhat_00020.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-federation\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-24.SP12_redhat_00016.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-undertow\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.2.40-2.SP3_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-wildfly\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:7.4.25-2.GA_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"],\"versions\":[{\"version\":\"ext-jdk15on\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"ext-jdk18on\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk12\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap8-bouncycastle\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8\"],\"versions\":[{\"version\":\"0:1.84.0-1.redhat_00001.1.el8eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap8-bouncycastle\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"],\"versions\":[{\"version\":\"0:1.84.0-1.redhat_00001.1.el9eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.12::el8\"],\"versions\":[{\"version\":\"1786628667\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.13::el8\"],\"versions\":[{\"version\":\"1786628681\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.14::el8\"],\"versions\":[{\"version\":\"1786533561\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.15::el8\"],\"versions\":[{\"version\":\"1786533565\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.16::el9\"],\"versions\":[{\"version\":\"1787125166\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.17::el9\"],\"versions\":[{\"version\":\"1787124635\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.18::el9\"],\"versions\":[{\"version\":\"1787125069\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.19::el9\"],\"versions\":[{\"version\":\"1787124632\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.20::el9\"],\"versions\":[{\"version\":\"1787124925\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.21::el9\"],\"versions\":[{\"version\":\"1787125311\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.22::el9\"],\"versions\":[{\"version\":\"1787124779\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/openvsx-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1779528224\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/pluginregistry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1779359423\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jenkins\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jenkins-2-plugins\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-lts8on\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk15on\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-lts8on\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pki-core:10.6/resteasy\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pki-deps:10.6/resteasy\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jmc\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"resteasy\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-debug-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk16\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk12\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk12\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on-1.83.0.redhat-00001.jar\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-modelmesh-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-modelmesh-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite:el8/candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NEGLIGIBLE\",\"Automatable\":\"YES\",\"Recovery\":\"AUTOMATIC\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\"}}],\"cvssMetricV31\":[{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-15T13:12:14.838595Z\",\"id\":\"CVE-2026-0636\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-90\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-90\"}]}],\"references\":[{\"url\":\"https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde\",\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\"},{\"url\":\"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636\",\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11720\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11721\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13631\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14272\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14276\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17668\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18054\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18055\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18059\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21772\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53806\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60239\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60246\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60247\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60248\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60249\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60251\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60252\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60254\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60256\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60259\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-0636\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2458641\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-09-10T21:21:43+00:00",
"cve": "CVE-2026-0636",
"id": "CVE-2026-0636",
"initial_release_date": "2026-04-15T08:59:12.677000+00:00",
"product_status:fixed": "170",
"product_status:known_affected": "24",
"product_status:known_not_affected": "335",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:amq_broker:7.12\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7.12.7\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7.13\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7.13.5\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_quarkus:3.27\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Apache Camel 4.14 for Quarkus 3.27\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"debug-jdk15on\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"bcprov\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"packageName\": \"bcprov-lts8on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.20::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.20.6.SP1\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.27::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.27.3.SP1\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4.25\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.16.0-22.redhat_00057.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-activemq-artemis\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.3.14-11.SP11_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-glassfish-jsf\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.5.26-2.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-ironjacamar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-annotations\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-databind\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-jaxrs-providers\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-java8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:5.0.31-3.SP2_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-remoting\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.10.0-46.Final_redhat_00044.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-server-migration\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty-transport-native-epoll\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-30.SP12_redhat_00020.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-bindings\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-24.SP12_redhat_00016.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-federation\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.2.40-2.SP3_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-undertow\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:7.4.25-2.GA_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-wildfly\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"ext-jdk15on\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"ext-jdk18on\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"bcprov\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk12\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.84.0-1.redhat_00001.1.el8eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap8-bouncycastle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.84.0-1.redhat_00001.1.el9eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap8-bouncycastle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628667\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.13::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628681\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.14::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533561\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533565\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125166\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124635\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125069\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124632\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.20\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124925\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.21\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125311\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124779\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779528224\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/openvsx-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779359423\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/pluginregistry-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"jenkins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"jenkins-2-plugins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_clients:2023\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Clients\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_clients:2023\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Clients\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"bcprov-lts8on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"bcprov-ext-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"bcprov-lts8on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"pki-core:10.6/resteasy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"pki-deps:10.6/resteasy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"jmc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"resteasy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-debug-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-ext-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-ext-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk16\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcprov-jdk12\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-ext-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-ext-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk12\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk18on-1.83.0.redhat-00001.jar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-modelmesh-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-modelmesh-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite:el8/candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-15T10:01:32.911Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-15T08:59:12.677Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18054: Red Hat JBoss EAP 8.1 for RHEL 8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18055: Red Hat JBoss EAP 8.1 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60247: OpenShift Developer Tools and Services 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60249: OpenShift Developer Tools and Services 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60248: OpenShift Developer Tools and Services 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60239: OpenShift Developer Tools and Services 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60251: OpenShift Developer Tools and Services 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60246: OpenShift Developer Tools and Services 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60250: OpenShift Developer Tools and Services 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60252: OpenShift Developer Tools and Services 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60259: OpenShift Developer Tools and Services 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60254: OpenShift Developer Tools and Services 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60256: OpenShift Developer Tools and Services 4.22\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14276: Red Hat AMQ Broker 7.12.7\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14272: Red Hat AMQ Broker 7.13.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13631: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18059: Red Hat JBoss Enterprise Application Platform 8.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11720: Red Hat build of Quarkus 3.20.6.SP1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11721: Red Hat build of Quarkus 3.27.3.SP1\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-15T08:59:12.677Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-0636\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2458641\", \"name\": \"RHBZ#2458641\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18054\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18055\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60247\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60249\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60248\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60239\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60251\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60246\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60250\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60252\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60259\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60254\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60256\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14276\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14272\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13631\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53806\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18059\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21772\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17668\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11720\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11721\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-90\", \"description\": \"Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-09-09T12:05:08.413Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-0636\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-15T13:12:14.838595Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-15T13:12:16.829Z\"}}], \"cna\": {\"title\": \"LDAP Injection Vulnerability in LDAPStoreHelper.java\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Prasanth Sundararajan (prasanth.srihari@gmail.com)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NEGLIGIBLE\", \"version\": \"4.0\", \"Recovery\": \"AUTOMATIC\", \"baseScore\": 5.5, \"Automatable\": \"YES\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber\", \"exploitMaturity\": \"PROOF_OF_CONCEPT\", \"providerUrgency\": \"AMBER\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/bcgit/bc-java\", \"vendor\": \"Legion of the Bouncy Castle Inc.\", \"modules\": [\"prov\"], \"product\": \"BC-JAVA\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.74\", \"lessThan\": \"1.80.2\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"1.81\", \"lessThan\": \"1.81.1\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"1.82\", \"lessThan\": \"1.84\", \"versionType\": \"maven\"}], \"platforms\": [\"all\"], \"packageName\": \"bcprov\", \"programFiles\": [\"LDAPStoreHelper\"], \"collectionURL\": \"https://www.bouncycastle.org/download/bouncy-castle-java/\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\\n\\n This vulnerability is associated with program files LDAPStoreHelper.\\n\\n\\n\\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\u003cp\u003e This vulnerability is associated with program files LDAPStoreHelper.\u003c/p\u003e\u003cp\u003eThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-90\", \"description\": \"CWE-90 Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"91579145-5d7b-4cc5-b925-a0262ff19630\", \"shortName\": \"bcorg\", \"dateUpdated\": \"2026-05-18T23:20:07.728Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-0636\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-09T12:05:08.413Z\", \"dateReserved\": \"2026-01-06T03:18:21.572Z\", \"assignerOrgId\": \"91579145-5d7b-4cc5-b925-a0262ff19630\", \"datePublished\": \"2026-04-15T08:59:12.677Z\", \"assignerShortName\": \"bcorg\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:60252
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-10 21:52Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60252",
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60252.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.",
"tracking": {
"current_release_date": "2026-09-10T21:52:11+00:00",
"generator": {
"date": "2026-09-10T21:52:11+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60252",
"initial_release_date": "2026-08-26T10:51:37+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:37+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T21:52:11+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.19",
"product": {
"name": "OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.19::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Aa0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ab952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60254
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-10 21:52Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60254",
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60254.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.",
"tracking": {
"current_release_date": "2026-09-10T21:52:09+00:00",
"generator": {
"date": "2026-09-10T21:52:09+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60254",
"initial_release_date": "2026-08-26T10:51:44+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:44+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T21:52:09+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.21",
"product": {
"name": "OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.21::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125679"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Aa01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125311"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Ad65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125679"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125311"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125679"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Aeb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125311"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125679"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125311"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60256
Vulnerability from csaf_redhat - Published: 2026-08-26 10:52 - Updated: 2026-09-10 21:52Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60256",
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60256.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.",
"tracking": {
"current_release_date": "2026-09-10T21:52:09+00:00",
"generator": {
"date": "2026-09-10T21:52:09+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60256",
"initial_release_date": "2026-08-26T10:52:02+00:00",
"revision_history": [
{
"date": "2026-08-26T10:52:02+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T21:52:09+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.22",
"product": {
"name": "OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.22::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125563"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124779"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125563"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ad62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124779"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125563"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Aadac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124779"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125563"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124779"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60259
Vulnerability from csaf_redhat - Published: 2026-08-26 10:57 - Updated: 2026-09-10 21:52Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60259",
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60259.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.",
"tracking": {
"current_release_date": "2026-09-10T21:52:09+00:00",
"generator": {
"date": "2026-09-10T21:52:09+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60259",
"initial_release_date": "2026-08-26T10:57:33+00:00",
"revision_history": [
{
"date": "2026-08-26T10:57:33+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T21:52:09+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.20",
"product": {
"name": "OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.20::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125493"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124925"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125493"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124925"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125493"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124925"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125493"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ab89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124925"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:66488
Vulnerability from csaf_redhat - Published: 2026-09-10 16:34 - Updated: 2026-09-10 22:11Summary
Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update
Severity
Important
Notes
Topic: Red Hat AMQ Broker 7.14.1 is now available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms.
This release of Red Hat AMQ Broker 7.14.1 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* (CVE-2025-14813) bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly
* (CVE-2026-0636) bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java
* (CVE-2026-10050) jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision
* (CVE-2026-12143) form-data: form-data: Form field override via CRLF injection
* (CVE-2026-12151) undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames
* (CVE-2026-13149) brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
* (CVE-2026-13676) fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
* (CVE-2026-40983) micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests
* (CVE-2026-40984) micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests
* (CVE-2026-42198) postgresql: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication
* (CVE-2026-42264) axios: Axios: Prototype pollution allows information disclosure and request manipulation
* (CVE-2026-42338) ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
* (CVE-2026-42578) netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
* (CVE-2026-42581) netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers
* (CVE-2026-42583) netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder
* (CVE-2026-42584) netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion
* (CVE-2026-42587) netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
* (CVE-2026-42587) netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
* (CVE-2026-42588) activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge
* (CVE-2026-44248) netty-codec-mqtt: Netty: Denial of Service due to excessive resource consumption from crafted MQTT 5 header
* (CVE-2026-44249) netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation
* (CVE-2026-44486) axios: Axios: Information disclosure of proxy credentials via HTTP redirects
* (CVE-2026-44487) axios: Axios: Information disclosure of proxy credentials via redirect flows
* (CVE-2026-44488) axios: Axios: Denial of Service due to unenforced request and response size limits
* (CVE-2026-44492) axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization
* (CVE-2026-44494) axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution
* (CVE-2026-44496) axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name
* (CVE-2026-44893) netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message
* (CVE-2026-45205) commons-configuration2: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input
* (CVE-2026-45416) netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake
* (CVE-2026-45736) ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
* (CVE-2026-48043) netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak
* (CVE-2026-48059) netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers
* (CVE-2026-48779) ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
* (CVE-2026-49362) artemis-server: artemis core protocol permits unauthed queue creation
* (CVE-2026-49364) artemis-server: artemis cluster password leak via jgroups spoof
* (CVE-2026-49432) artemis-stomp-protocol: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector
* (CVE-2026-49978) dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
* (CVE-2026-50010) netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass
* (CVE-2026-50734) activemq-client: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame
* (CVE-2026-53916) artemis-stomp-protocol: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec
* (CVE-2026-54512) jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
* (CVE-2026-54513) jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
* (CVE-2026-55831) netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
* (CVE-2026-55833) netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification
* (CVE-2026-55851) netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message
* (CVE-2026-5588) bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid
* (CVE-2026-56745) netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
* (CVE-2026-56746) netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header
* (CVE-2026-56819) netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
* (CVE-2026-57967) artemis-server: Apache Artemis — session hijack via missing authentication
* (CVE-2026-59869) js-yaml: js-yaml: Denial of Service via crafted YAML documents
* (CVE-2026-59873) tar: node-tar: Denial of Service via crafted gzip bomb
* (CVE-2026-59874) tar: Node-tar: Denial of Service via malformed tar archive header
* (CVE-2026-59899) netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)
* (CVE-2026-62243) netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration
* (CVE-2026-66257) proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching
* (CVE-2026-66273) proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation
* (CVE-2026-66274) amq-broker-maven-repository.zip: Apache Qpid Proton-J: Denial of Service via unbounded type nesting
* (CVE-2026-66274) amq-broker-bin.zip: Apache Qpid Proton-J: Denial of Service via unbounded type nesting
* (CVE-2026-67593) artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo
* (CVE-2026-68494) amq-broker-bin.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser
* (CVE-2026-68494) amq-broker-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser
* (CVE-2026-9595) webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration
* (CVE-2026-10051) jetty-server: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
* (CVE-2026-34478) log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames
* (CVE-2026-34480) log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging
* (CVE-2026-34481) log4j-layout-template-json: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output
* (CVE-2026-49363) artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0
* (CVE-2026-57822) artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket (ws: true) forwarding, the development server's own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser's cookies and Origin header to the proxy target, bypassing the server's Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality.
7.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain characters, leading to a weakness in how passwords are processed. A remote attacker could exploit this by crafting a specific password that generates the same internal hash as a legitimate user's password, thereby bypassing authentication and gaining unauthorized access to the victim's account.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous and current request trailers.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion, resulting in a denial of service (DoS) for affected applications using the undici WebSocket client or WebSocketStream API.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed (CRLF) sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-based syslog services. An attacker could exploit this to inject malicious data into log files, potentially obscuring critical security events or manipulating system records.
5.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML output becomes invalid. This can lead to two main issues: either systems processing these logs will fail to read the affected records, or the logging process itself will stop delivering events, both resulting in a denial of service for logging operations.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Apache Log4j's JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This invalid output can then lead to downstream systems rejecting or failing to index these logs, effectively causing a denial of service for log analysis.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC (gRPC Remote Procedure Call) requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A malicious server can exploit this vulnerability by instructing the driver to perform SCRAM-SHA-256 (Salted Challenge Response Authentication Mechanism Secure Hash Algorithm 256) authentication with an excessively large iteration count. This causes the client to spend an unbounded amount of CPU time performing PBKDF2 (Password-Based Key Derivation Function 2) computations, leading to a client-side Denial of Service (DoS). This can exhaust client CPU resources and wedge connection pools.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object prototype, Axios can unknowingly use these manipulated values in its outbound network requests. This could lead to the disclosure of sensitive information or the alteration of network communications, compromising data confidentiality and integrity.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by providing untrusted input to the Address6 constructor. When an application renders the output of Address6.group(), Address6.link(), or the AddressError.parseMessage as HTML without proper escaping, the attacker-controlled content can be executed in the user's browser.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory (up to 32 MB per block) before the LZ4 decompression runs, leading to excessive memory consumption and a denial of service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context. This allows for arbitrary code execution on the broker's Java Virtual Machine (JVM).
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous event-driven network application framework. A remote attacker can exploit this vulnerability by sending a crafted MQTT 5 header with an oversized Properties section. This causes Netty to repeatedly parse and buffer the large Properties section in memory before any message size limits are applied, leading to high CPU and memory consumption. This can result in a Denial of Service (DoS) condition, making the affected system unavailable.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.
8.6 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.
8.7 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that consume excessive memory. Consequently, this leads to process termination and a denial of service (DoS) for the remote peer.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATE_QUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state manipulation.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBE_TOPOLOGY_V2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore(), no credential verification, no subject validation. An unauthenticated attacker can send a single 5-byte packet on the CORE protocol (via :8080 HTTP-upgrade in EAP or :61616 in AMQ Broker) to obtain the broker's nodeID (type-1 UUID embedding MAC address), internal hostname/IP, port numbers, connector configurations, and backup/scale-down group names. In clustered deployments, a persistent ClusterTopologyListener is registered that continuously pushes all topology changes to the unauthenticated client. This contrasts with the federation handler in the same file which was fixed via ARTEMIS-5928 (CVE-2026-27446). The leaked nodeID UUID seed directly enables session-name brute-force for REATTACH_SESSION session hijack.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations.
8.0 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Apache ActiveMQ. A remote, unauthenticated attacker can exploit an improper input validation vulnerability by sending a specially crafted message with a negative content-length to an exposed STOMP connector. This can lead to a denial of service (DoS) condition, either by consuming excessive memory and causing an Out-Of-Memory (OOM) error or by forcing the abnormal closure of affected connections.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a `<template>.content`. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache ActiveMQ. An unauthenticated network attacker can exploit this vulnerability by sending a specially crafted WireFormatInfo frame with an excessively large size value. This unvalidated value causes the broker to attempt an oversized memory allocation during pre-authentication negotiation. Consequently, this can lead to an Out Of Memory (OOM) error, resulting in a Denial of Service (DoS) and crashing the broker.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service (DoS) due to heap growth and increased CPU usage.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to excessive CPU usage and memory allocation. This can result in a denial of service (DoS) due to resource exhaustion.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service (DoS) due to memory exhaustion.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the `CorsHandler` component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the backend application. This could lead to a compromise of data integrity by allowing unauthorized actions.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing the application to crash and resulting in a Denial of Service (DoS). The issue occurs because the framework fails to release retained memory buffers when processing DATA frames for a stream whose decompressor has already been closed.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray() method uses ObjectInputStream.readObject() to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an allowlist (java.util,java.lang,javax.management) that blocks RCE gadget chains, an authenticated attacker with the MANAGE role can craft a deserialization bomb using deeply nested java.util.HashSet/HashMap structures to exhaust CPU/memory and crash the broker JVM, causing denial of service for all connected clients.
4.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
in Apache Artemis, the REATTACH_SESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled (default). The processRemoveSubscription() method executes pre-authentication with no authorization check, and uses the internal destroyQueue(SimpleString) overload that skips security entirely. Default queues DLQ and ExpiryQueue are trivially targetable. This is unfixed in all Artemis versions through 2.55.0.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.14.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.14
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
References
476 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AMQ Broker 7.14.1 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms.\n\nThis release of Red Hat AMQ Broker 7.14.1 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* (CVE-2025-14813) bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly\n* (CVE-2026-0636) bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java\n* (CVE-2026-10050) jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision\n* (CVE-2026-12143) form-data: form-data: Form field override via CRLF injection\n* (CVE-2026-12151) undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames\n* (CVE-2026-13149) brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n* (CVE-2026-13676) fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization\n* (CVE-2026-40983) micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests\n* (CVE-2026-40984) micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests\n* (CVE-2026-42198) postgresql: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication\n* (CVE-2026-42264) axios: Axios: Prototype pollution allows information disclosure and request manipulation\n* (CVE-2026-42338) ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input\n* (CVE-2026-42578) netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation\n* (CVE-2026-42581) netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers\n* (CVE-2026-42583) netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder\n* (CVE-2026-42584) netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion\n* (CVE-2026-42587) netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression\n* (CVE-2026-42587) netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression\n* (CVE-2026-42588) activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge\n* (CVE-2026-44248) netty-codec-mqtt: Netty: Denial of Service due to excessive resource consumption from crafted MQTT 5 header\n* (CVE-2026-44249) netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation\n* (CVE-2026-44486) axios: Axios: Information disclosure of proxy credentials via HTTP redirects\n* (CVE-2026-44487) axios: Axios: Information disclosure of proxy credentials via redirect flows\n* (CVE-2026-44488) axios: Axios: Denial of Service due to unenforced request and response size limits\n* (CVE-2026-44492) axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization\n* (CVE-2026-44494) axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution\n* (CVE-2026-44496) axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name\n* (CVE-2026-44893) netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message\n* (CVE-2026-45205) commons-configuration2: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input\n* (CVE-2026-45416) netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake\n* (CVE-2026-45736) ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n* (CVE-2026-48043) netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak\n* (CVE-2026-48059) netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers\n* (CVE-2026-48779) ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n* (CVE-2026-49362) artemis-server: artemis core protocol permits unauthed queue creation\n* (CVE-2026-49364) artemis-server: artemis cluster password leak via jgroups spoof\n* (CVE-2026-49432) artemis-stomp-protocol: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector\n* (CVE-2026-49978) dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution\n* (CVE-2026-50010) netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass\n* (CVE-2026-50734) activemq-client: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame\n* (CVE-2026-53916) artemis-stomp-protocol: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec\n* (CVE-2026-54512) jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass\n* (CVE-2026-54513) jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution\n* (CVE-2026-55831) netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing\n* (CVE-2026-55833) netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification\n* (CVE-2026-55851) netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message\n* (CVE-2026-5588) bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid\n* (CVE-2026-56745) netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec\n* (CVE-2026-56746) netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header\n* (CVE-2026-56819) netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak\n* (CVE-2026-57967) artemis-server: Apache Artemis \u2014 session hijack via missing authentication\n* (CVE-2026-59869) js-yaml: js-yaml: Denial of Service via crafted YAML documents\n* (CVE-2026-59873) tar: node-tar: Denial of Service via crafted gzip bomb\n* (CVE-2026-59874) tar: Node-tar: Denial of Service via malformed tar archive header\n* (CVE-2026-59899) netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)\n* (CVE-2026-62243) netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration\n* (CVE-2026-66257) proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching\n* (CVE-2026-66273) proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation\n* (CVE-2026-66274) amq-broker-maven-repository.zip: Apache Qpid Proton-J: Denial of Service via unbounded type nesting\n* (CVE-2026-66274) amq-broker-bin.zip: Apache Qpid Proton-J: Denial of Service via unbounded type nesting\n* (CVE-2026-67593) artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo\n* (CVE-2026-68494) amq-broker-bin.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser\n* (CVE-2026-68494) amq-broker-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser\n* (CVE-2026-9595) webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration\n* (CVE-2026-10051) jetty-server: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections\n* (CVE-2026-34478) log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames\n* (CVE-2026-34480) log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging\n* (CVE-2026-34481) log4j-layout-template-json: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output\n* (CVE-2026-49363) artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0\n* (CVE-2026-57822) artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:66488",
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification#important",
"url": "https://access.redhat.com/security/updates/classification#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.14.1",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.14.1"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_amq_broker/7.14",
"url": "https://docs.redhat.com/en/documentation/red_hat_amq_broker/7.14"
},
{
"category": "external",
"summary": "2457321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457321"
},
{
"category": "external",
"summary": "2457323",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457323"
},
{
"category": "external",
"summary": "2457328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457328"
},
{
"category": "external",
"summary": "2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "2463857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463857"
},
{
"category": "external",
"summary": "2467927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467927"
},
{
"category": "external",
"summary": "2476810",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476810"
},
{
"category": "external",
"summary": "2477219",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477219"
},
{
"category": "external",
"summary": "2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "2477231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477231"
},
{
"category": "external",
"summary": "2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "2477425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477425"
},
{
"category": "external",
"summary": "2477914",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477914"
},
{
"category": "external",
"summary": "2477945",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477945"
},
{
"category": "external",
"summary": "2478013",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478013"
},
{
"category": "external",
"summary": "2480638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480638"
},
{
"category": "external",
"summary": "2486488",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486488"
},
{
"category": "external",
"summary": "2486697",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486697"
},
{
"category": "external",
"summary": "2486716",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486716"
},
{
"category": "external",
"summary": "2487938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487938"
},
{
"category": "external",
"summary": "2487942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487942"
},
{
"category": "external",
"summary": "2487943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487943"
},
{
"category": "external",
"summary": "2487947",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487947"
},
{
"category": "external",
"summary": "2487948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487948"
},
{
"category": "external",
"summary": "2487949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487949"
},
{
"category": "external",
"summary": "2488081",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
},
{
"category": "external",
"summary": "2488383",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
},
{
"category": "external",
"summary": "2488391",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
},
{
"category": "external",
"summary": "2488429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
},
{
"category": "external",
"summary": "2488437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
},
{
"category": "external",
"summary": "2488442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
},
{
"category": "external",
"summary": "2488480",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488480"
},
{
"category": "external",
"summary": "2488934",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488934"
},
{
"category": "external",
"summary": "2489661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661"
},
{
"category": "external",
"summary": "2489980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"
},
{
"category": "external",
"summary": "2492010",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
},
{
"category": "external",
"summary": "2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "2492627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492627"
},
{
"category": "external",
"summary": "2494197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
},
{
"category": "external",
"summary": "2494813",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
},
{
"category": "external",
"summary": "2494841",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494841"
},
{
"category": "external",
"summary": "2494846",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494846"
},
{
"category": "external",
"summary": "2494847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494847"
},
{
"category": "external",
"summary": "2495823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495823"
},
{
"category": "external",
"summary": "2498116",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
},
{
"category": "external",
"summary": "2498120",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
},
{
"category": "external",
"summary": "2498122",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
},
{
"category": "external",
"summary": "2499928",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499928"
},
{
"category": "external",
"summary": "2500695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
},
{
"category": "external",
"summary": "2503101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503101"
},
{
"category": "external",
"summary": "2503103",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503103"
},
{
"category": "external",
"summary": "2505422",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505422"
},
{
"category": "external",
"summary": "2505698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505698"
},
{
"category": "external",
"summary": "2505911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505911"
},
{
"category": "external",
"summary": "2505980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505980"
},
{
"category": "external",
"summary": "2507482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507482"
},
{
"category": "external",
"summary": "2510277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510277"
},
{
"category": "external",
"summary": "2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "2511322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
},
{
"category": "external",
"summary": "2511326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
},
{
"category": "external",
"summary": "2511337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
},
{
"category": "external",
"summary": "2521309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
},
{
"category": "external",
"summary": "ENTMQBR-10632",
"url": "https://issues.redhat.com/browse/ENTMQBR-10632"
},
{
"category": "external",
"summary": "ENTMQBR-10635",
"url": "https://issues.redhat.com/browse/ENTMQBR-10635"
},
{
"category": "external",
"summary": "ENTMQBR-10650",
"url": "https://issues.redhat.com/browse/ENTMQBR-10650"
},
{
"category": "external",
"summary": "ENTMQBR-10730",
"url": "https://issues.redhat.com/browse/ENTMQBR-10730"
},
{
"category": "external",
"summary": "ENTMQBR-10731",
"url": "https://issues.redhat.com/browse/ENTMQBR-10731"
},
{
"category": "external",
"summary": "ENTMQBR-10732",
"url": "https://issues.redhat.com/browse/ENTMQBR-10732"
},
{
"category": "external",
"summary": "ENTMQBR-10810",
"url": "https://issues.redhat.com/browse/ENTMQBR-10810"
},
{
"category": "external",
"summary": "ENTMQBR-10911",
"url": "https://issues.redhat.com/browse/ENTMQBR-10911"
},
{
"category": "external",
"summary": "ENTMQBR-10935",
"url": "https://issues.redhat.com/browse/ENTMQBR-10935"
},
{
"category": "external",
"summary": "ENTMQBR-10990",
"url": "https://issues.redhat.com/browse/ENTMQBR-10990"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66488.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update",
"tracking": {
"current_release_date": "2026-09-10T22:11:50+00:00",
"generator": {
"date": "2026-09-10T22:11:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:66488",
"initial_release_date": "2026-09-10T16:34:06+00:00",
"revision_history": [
{
"date": "2026-09-10T16:34:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-10T16:34:06+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T22:11:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat AMQ Broker 7.14.1",
"product": {
"name": "Red Hat AMQ Broker 7.14.1",
"product_id": "Red Hat AMQ Broker 7.14.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:amq_broker:7.14"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss AMQ"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-9595",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-06-15T16:01:15.427658+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488934"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as \u0027/\u0027, and enables WebSocket (ws: true) forwarding, the development server\u0027s own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser\u0027s cookies and Origin header to the proxy target, bypassing the server\u0027s Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9595"
},
{
"category": "external",
"summary": "RHBZ#2488934",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488934"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9595"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/facebook/create-react-app/pull/7444",
"url": "https://github.com/facebook/create-react-app/pull/7444"
},
{
"category": "external",
"summary": "https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb",
"url": "https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb"
},
{
"category": "external",
"summary": "https://github.com/webpack/webpack-dev-server/pull/4316",
"url": "https://github.com/webpack/webpack-dev-server/pull/4316"
},
{
"category": "external",
"summary": "https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79",
"url": "https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79"
}
],
"release_date": "2026-06-15T15:00:21.488000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid configuring `webpack-dev-server` with a broad proxy context (e.g., `/`) when WebSocket forwarding (`ws: true`) is enabled. Instead, define specific paths for the proxy context. Alternatively, disable WebSocket forwarding by omitting `ws: true` from the proxy entry if WebSocket functionality is not required for the proxy target. This configuration change may require restarting the `webpack-dev-server` instance to take effect.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration"
},
{
"cve": "CVE-2026-10050",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510732"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty\u0027s hash computation for passwords does not correctly handle certain characters, leading to a weakness in how passwords are processed. A remote attacker could exploit this by crafting a specific password that generates the same internal hash as a legitimate user\u0027s password, thereby bypassing authentication and gaining unauthorized access to the victim\u0027s account.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw allows an authentication bypass in Eclipse Jetty\u0027s HTTP Digest authentication. An attacker who knows a victim\u0027s username can craft a collision password if the original password contains non-Latin-1 characters, leading to unauthorized access in affected Red Hat products that utilize this authentication method.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10050"
},
{
"category": "external",
"summary": "RHBZ#2510732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510732"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10050",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10050"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10050",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10050"
}
],
"release_date": "2026-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that all user passwords configured for HTTP Digest authentication in affected Eclipse Jetty deployments exclusively use characters within the Latin-1 character set. This prevents the character encoding collision that leads to authentication bypass.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision"
},
{
"cve": "CVE-2026-10051",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-14T10:01:09.470495+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499928"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous and current request trailers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: This information disclosure flaw in Eclipse Jetty allows HTTP/1.1 trailers from a previous request to be retained and subsequently exposed to other requests sharing the same connection. This could lead to unintended disclosure of sensitive information in Red Hat products utilizing Jetty, such as Red Hat AMQ and Enterprise Application Platform, particularly when connection reuse is active and trailers contain confidential data. The confidentiality impact is considered low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10051"
},
{
"category": "external",
"summary": "RHBZ#2499928",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499928"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10051"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10051",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10051"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119"
}
],
"release_date": "2026-07-14T08:44:38.233000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections"
},
{
"cve": "CVE-2026-12143",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-06-12T19:00:57.360953+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488480"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (\") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "form-data: form-data: Form field override via CRLF injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important impact flaw in the form-data library: a remote attacker can inject arbitrary headers or additional multipart parts via CRLF injection in field names or filenames, potentially overriding sensitive form fields and affecting data integrity.\n\nFor RHOAI and RHEL AI, severity is Moderate because affected versions appear only as a transitive npm dependency in RHOAI (dashboard, mod-arch plugins, MLflow UI) and RHEL AI 3.4 bootc images, and those products use fixed field names for uploads rather than passing untrusted user input as multipart field names or filenames. The documented exploit path is therefore not reachable in default deployments. Practical impact is limited to non-default or custom integrations that forward multipart requests using attacker-controlled field names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "RHBZ#2488480",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488480"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/93.html",
"url": "https://cwe.mitre.org/data/definitions/93.html"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435",
"url": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229",
"url": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045",
"url": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx",
"url": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx"
},
{
"category": "external",
"summary": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data",
"url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/form-data",
"url": "https://www.npmjs.com/package/form-data"
}
],
"release_date": "2026-06-12T18:01:30.362000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, \") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "form-data: form-data: Form field override via CRLF injection"
},
{
"cve": "CVE-2026-12151",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-17T17:01:45.297604+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2489980"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion, resulting in a denial of service (DoS) for affected applications using the undici WebSocket client or WebSocketStream API.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in the `undici` WebSocket client allows a remote attacker to cause unbounded memory growth. By sending numerous small or empty WebSocket frames, an unauthenticated attacker can exhaust system memory, leading to a denial of service in Red Hat products that use the affected client.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12151"
},
{
"category": "external",
"summary": "RHBZ#2489980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12151"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q"
}
],
"release_date": "2026-06-17T16:05:38.785000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames"
},
{
"cve": "CVE-2026-13149",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-06-30T10:00:59.843854+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494813"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13149"
},
{
"category": "external",
"summary": "RHBZ#2494813",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/brace-expansion",
"url": "https://www.npmjs.com/package/brace-expansion"
}
],
"release_date": "2026-06-30T08:30:34.502000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
},
{
"cve": "CVE-2026-13676",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-06-29T14:01:55.592330+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494197"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13676"
},
{
"category": "external",
"summary": "RHBZ#2494197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
}
],
"release_date": "2026-06-29T13:22:44.674000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
},
{
"cve": "CVE-2026-34478",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-04-10T16:01:52.683616+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457323"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed (CRLF) sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-based syslog services. An attacker could exploit this to inject malicious data into log files, potentially obscuring critical security events or manipulating system records.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability allows log injection via CRLF sequences due to silently renamed security attributes in Rfc5424Layout. This affects Red Hat products that directly configure Rfc5424Layout with stream-based syslog services, potentially enabling an attacker to obscure or manipulate log records. This impact is limited to specific configurations, as users of the SyslogAppender are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34478"
},
{
"category": "external",
"summary": "RHBZ#2457323",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457323"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34478"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34478",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34478"
},
{
"category": "external",
"summary": "https://github.com/apache/logging-log4j2/pull/4074",
"url": "https://github.com/apache/logging-log4j2/pull/4074"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt",
"url": "https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt"
},
{
"category": "external",
"summary": "https://logging.apache.org/cyclonedx/vdr.xml",
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout",
"url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout"
},
{
"category": "external",
"summary": "https://logging.apache.org/security.html#CVE-2026-34478",
"url": "https://logging.apache.org/security.html#CVE-2026-34478"
}
],
"release_date": "2026-04-10T15:40:17.713000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames"
},
{
"cve": "CVE-2026-34480",
"cwe": {
"id": "CWE-168",
"name": "Improper Handling of Inconsistent Special Elements"
},
"discovery_date": "2026-04-10T16:02:17.024798+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457328"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML output becomes invalid. This can lead to two main issues: either systems processing these logs will fail to read the affected records, or the logging process itself will stop delivering events, both resulting in a denial of service for logging operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in Apache Log4j Core\u0027s XmlLayout component can lead to a denial of service in logging operations when log messages contain characters forbidden by the XML 1.0 specification. Systems processing these logs may fail to read records or the logging process may cease event delivery, impacting monitoring and auditing capabilities in affected Red Hat products. Red Hat products in their default configurations will be able to automatically recover, but some log messages may be lost.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34480"
},
{
"category": "external",
"summary": "RHBZ#2457328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457328"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34480"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480"
},
{
"category": "external",
"summary": "https://github.com/apache/logging-log4j2/pull/4077",
"url": "https://github.com/apache/logging-log4j2/pull/4077"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb",
"url": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb"
},
{
"category": "external",
"summary": "https://logging.apache.org/cyclonedx/vdr.xml",
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout",
"url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout"
},
{
"category": "external",
"summary": "https://logging.apache.org/security.html#CVE-2026-34480",
"url": "https://logging.apache.org/security.html#CVE-2026-34480"
}
],
"release_date": "2026-04-10T15:42:03.843000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging"
},
{
"cve": "CVE-2026-34481",
"cwe": {
"id": "CWE-241",
"name": "Improper Handling of Unexpected Data Type"
},
"discovery_date": "2026-04-10T16:01:44.581898+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Log4j\u0027s JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This invalid output can then lead to downstream systems rejecting or failing to index these logs, effectively causing a denial of service for log analysis.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires an application to be configured with JsonTemplateLayout and to log attacker-controlled non-finite floating-point values within a MapMessage, which is not a default or common configuration in Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34481"
},
{
"category": "external",
"summary": "RHBZ#2457321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34481"
},
{
"category": "external",
"summary": "https://github.com/apache/logging-log4j2/pull/4080",
"url": "https://github.com/apache/logging-log4j2/pull/4080"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv",
"url": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv"
},
{
"category": "external",
"summary": "https://logging.apache.org/cyclonedx/vdr.xml",
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html",
"url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html"
},
{
"category": "external",
"summary": "https://logging.apache.org/security.html#CVE-2026-34481",
"url": "https://logging.apache.org/security.html#CVE-2026-34481"
}
],
"release_date": "2026-04-10T15:43:00.100000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output"
},
{
"cve": "CVE-2026-40983",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-09T05:00:52.290020+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2486697"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC (gRPC Remote Procedure Call) requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service vulnerability in Micrometer, as a remote unauthenticated attacker can disrupt the availability of affected systems by sending specially crafted gRPC requests. The broad accessibility of gRPC endpoints in typical deployments contributes to the elevated risk, allowing for significant service interruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40983"
},
{
"category": "external",
"summary": "RHBZ#2486697",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486697"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40983",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40983"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40983",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40983"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40983",
"url": "https://spring.io/security/cve-2026-40983"
}
],
"release_date": "2026-06-09T03:46:54.131000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services exposing Micrometer\u0027s gRPC endpoints to trusted clients only. Implement firewall rules to limit inbound connections to the specific ports used by gRPC. If gRPC functionality is not essential for the deployment, consider disabling it entirely to eliminate the attack vector. Any changes to network configurations or service settings may require a service restart to take effect, potentially impacting availability during the transition.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests"
},
{
"cve": "CVE-2026-40984",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-09T05:01:51.700197+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2486716"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service vulnerability in Micrometer, a component present in several Red Hat products. A remote, unauthenticated attacker can exploit this flaw by sending specially crafted HTTP requests, leading to resource exhaustion and disrupting the availability of affected services. Exploitation of this flaw requires one or more HTTP server instrumentation(s), from one of the vulnerable components, to be configured to record metrics.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40984"
},
{
"category": "external",
"summary": "RHBZ#2486716",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486716"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40984",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40984"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40984",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40984"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40984",
"url": "https://spring.io/security/cve-2026-40984"
}
],
"release_date": "2026-06-09T03:47:46.447000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests"
},
{
"cve": "CVE-2026-42198",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-29T17:00:59.186447+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A malicious server can exploit this vulnerability by instructing the driver to perform SCRAM-SHA-256 (Salted Challenge Response Authentication Mechanism Secure Hash Algorithm 256) authentication with an excessively large iteration count. This causes the client to spend an unbounded amount of CPU time performing PBKDF2 (Password-Based Key Derivation Function 2) computations, leading to a client-side Denial of Service (DoS). This can exhaust client CPU resources and wedge connection pools.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42198"
},
{
"category": "external",
"summary": "RHBZ#2463857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42198"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42198",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42198"
},
{
"category": "external",
"summary": "https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11",
"url": "https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"
},
{
"category": "external",
"summary": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq",
"url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq"
}
],
"release_date": "2026-04-29T15:58:49.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication"
},
{
"cve": "CVE-2026-42264",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-05-08T04:02:21.039378+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467927"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system\u0027s object prototype, Axios can unknowingly use these manipulated values in its outbound network requests. This could lead to the disclosure of sensitive information or the alteration of network communications, compromising data confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Prototype pollution allows information disclosure and request manipulation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important prototype pollution flaw in Axios could result in information disclosure and network request manipulation. The vulnerability occurs when a co-located dependency in the application environment successfully pollutes the JavaScript `Object.prototype`. Under these conditions, Axios may unknowingly incorporate the manipulated properties into its outbound HTTP requests, potentially compromising data confidentiality and integrity. Exploitation is contingent on a prior successful prototype pollution attack from another component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42264"
},
{
"category": "external",
"summary": "RHBZ#2467927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467927"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42264"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42264",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42264"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa",
"url": "https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10779",
"url": "https://github.com/axios/axios/pull/10779"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.2",
"url": "https://github.com/axios/axios/releases/tag/v1.15.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj",
"url": "https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj"
}
],
"release_date": "2026-05-08T03:20:24.248000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Prototype pollution allows information disclosure and request manipulation"
},
{
"cve": "CVE-2026-42338",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-12T21:01:14.436876+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476810"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by providing untrusted input to the Address6 constructor. When an application renders the output of Address6.group(), Address6.link(), or the AddressError.parseMessage as HTML without proper escaping, the attacker-controlled content can be executed in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in the `ip-address` JavaScript library is rated as Important. It allows for cross-site scripting (XSS) when an application processes untrusted input through the `Address6` constructor and subsequently renders the unescaped output of methods like `Address6.group()`, `Address6.link()`, or `AddressError.parseMessage` directly as HTML. While the library itself is affected, exploitation is contingent on specific application-level rendering practices that may not be common in Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42338"
},
{
"category": "external",
"summary": "RHBZ#2476810",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476810"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42338"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42338",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42338"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g",
"url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g"
}
],
"release_date": "2026-05-12T19:43:16.470000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input"
},
{
"cve": "CVE-2026-42578",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-13T19:02:00.826936+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477226"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "RHBZ#2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
"url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
}
],
"release_date": "2026-05-13T17:57:43.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
},
{
"cve": "CVE-2026-42581",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:26.404511+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477232"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "RHBZ#2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
}
],
"release_date": "2026-05-13T17:54:44.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
},
{
"cve": "CVE-2026-42583",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:01:32.498598+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477219"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory (up to 32 MB per block) before the LZ4 decompression runs, leading to excessive memory consumption and a denial of service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Netty\u0027s LZ4FrameDecoder. The decoder allocates a buffer based on the decompressed length from the LZ4 frame header (up to 32 MB per block) before decompression runs. A remote attacker can send a small crafted LZ4 header (as few as 22 bytes) to force excessive memory allocation, leading to a denial of service. Red Hat products that use Netty with LZ4 compression enabled are affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42583"
},
{
"category": "external",
"summary": "RHBZ#2477219",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477219"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42583"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6",
"url": "https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6"
}
],
"release_date": "2026-05-13T18:09:19.817000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder"
},
{
"cve": "CVE-2026-42584",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:01:51.846351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "RHBZ#2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
}
],
"release_date": "2026-05-13T18:10:48.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:01:35.415881+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477220"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "RHBZ#2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"release_date": "2026-05-13T18:22:21.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
},
{
"cve": "CVE-2026-42588",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-06-01T10:03:00.412518+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2486488"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport\u0027s brokerConfig parameter to load a Spring XML application context. This allows for arbitrary code execution on the broker\u0027s Java Virtual Machine (JVM).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important arbitrary code execution flaw in Apache ActiveMQ Classic. An authenticated attacker can exploit improper input validation in the Jolokia JMX-HTTP bridge, exposed on the web console. By crafting a malicious discovery URI, an attacker can load a Spring XML application context, leading to arbitrary code execution within the broker\u0027s JVM. The requirement for prior authentication to the ActiveMQ web console limits the immediate exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42588"
},
{
"category": "external",
"summary": "RHBZ#2486488",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486488"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42588"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/05/31/18",
"url": "http://www.openwall.com/lists/oss-security/2026/05/31/18"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/ns0zktfo16s9ql2mmtqtlb6p6xcs45xm",
"url": "https://lists.apache.org/thread/ns0zktfo16s9ql2mmtqtlb6p6xcs45xm"
}
],
"release_date": "2026-06-01T07:23:17.287000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge"
},
{
"cve": "CVE-2026-44248",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:02:22.095946+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477231"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous event-driven network application framework. A remote attacker can exploit this vulnerability by sending a crafted MQTT 5 header with an oversized Properties section. This causes Netty to repeatedly parse and buffer the large Properties section in memory before any message size limits are applied, leading to high CPU and memory consumption. This can result in a Denial of Service (DoS) condition, making the affected system unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-mqtt: Netty: Denial of Service due to excessive resource consumption from crafted MQTT 5 header",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44248"
},
{
"category": "external",
"summary": "RHBZ#2477231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477231"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44248"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44248",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44248"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgx",
"url": "https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgx"
}
],
"release_date": "2026-05-13T18:23:37.563000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-mqtt: Netty: Denial of Service due to excessive resource consumption from crafted MQTT 5 header"
},
{
"cve": "CVE-2026-44249",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-11T22:02:05.327173+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488081"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in netty-handler is rated as Important because a remote attacker can bypass configured IPv6 subnet filtering rules. This flaw, stemming from an incorrect masking operation, could allow unauthorized access to or exposure of services that are intended to be network-restricted within Red Hat products utilizing the affected Netty component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44249"
},
{
"category": "external",
"summary": "RHBZ#2488081",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86",
"url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
}
],
"release_date": "2026-06-11T20:46:14.110000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation"
},
{
"cve": "CVE-2026-44486",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:30.944384+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487947"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in the Axios Node.js HTTP adapter. Red Hat products utilizing Axios in a Node.js environment with an authenticated proxy and automatic redirects enabled are susceptible. The vulnerability arises when a request, initially sent through an authenticated proxy, is redirected to a target that no longer uses the proxy, potentially leaking `Proxy-Authorization` headers containing sensitive credentials to an untrusted remote server. This risk is heightened in deployments where applications interact with untrusted HTTP origins.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "RHBZ#2487947",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487947"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44486"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc",
"url": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc"
}
],
"release_date": "2026-06-11T15:39:07.714000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects"
},
{
"cve": "CVE-2026-44487",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:34.091476+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487948"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in Axios affecting Node.js environments. When an application uses Axios with an authenticated HTTP proxy and follows redirects from an HTTP to a non-proxied HTTPS destination, the Proxy-Authorization header may be inadvertently sent to the final origin server. This could lead to the exposure of sensitive proxy credentials to an unintended third party.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "RHBZ#2487948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v",
"url": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v"
}
],
"release_date": "2026-06-11T15:38:25.150000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via redirect flows"
},
{
"cve": "CVE-2026-44488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T17:01:36.836488+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Denial of Service due to unenforced request and response size limits",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A denial of service flaw was found in Axios, a JavaScript HTTP client library. This issue arises when applications utilize the `fetch` adapter, as configured request and response size limits are not properly enforced. A remote attacker could exploit this by sending or receiving excessively large data bodies, leading to resource exhaustion and potential denial of service in affected server-side applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "RHBZ#2487949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf"
}
],
"release_date": "2026-06-11T15:37:38.013000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Denial of Service due to unenforced request and response size limits"
},
{
"cve": "CVE-2026-44492",
"cwe": {
"id": "CWE-289",
"name": "Authentication Bypass by Alternate Name"
},
"discovery_date": "2026-06-11T17:00:56.761751+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487938"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Axios, a JavaScript HTTP client library, that allows for a proxy bypass. When a `NO_PROXY` environment variable is configured to prevent direct connections to specific IPv4 addresses, an attacker can craft a request URL using the IPv4-mapped IPv6 address format. This bypasses the intended `NO_PROXY` exclusion, routing the request through the configured proxy and potentially exposing internal services or sensitive information, such as cloud instance metadata credentials.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "RHBZ#2487938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv"
}
],
"release_date": "2026-06-11T15:29:13.890000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization"
},
{
"cve": "CVE-2026-44494",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:01:12.945664+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487942"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to escalate any existing Object.prototype pollution in an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the Axios library allows an attacker to escalate existing prototype pollution vulnerabilities within an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. By injecting a malicious proxy configuration into the `Object.prototype`, an attacker can intercept, read, and modify all HTTP traffic, including sensitive authentication credentials, without direct user interaction. This poses a significant risk to data confidentiality and integrity in Red Hat products that utilize the Axios library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "RHBZ#2487942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487942"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh",
"url": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh"
}
],
"release_date": "2026-06-11T15:32:03.155000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution"
},
{
"cve": "CVE-2026-44496",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-06-11T17:01:15.856386+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487943"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Axios can lead to a client-side Denial of Service. An attacker capable of influencing the XSRF cookie name within a browser environment could trigger excessive regular expression processing, causing the affected browser tab to freeze and degrade user availability. This issue specifically impacts browser-based applications and does not affect Node.js HTTP adapter usage, React Native, or web workers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44496"
},
{
"category": "external",
"summary": "RHBZ#2487943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487943"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44496"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf"
}
],
"release_date": "2026-06-11T15:34:28.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name"
},
{
"cve": "CVE-2026-44893",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-06-12T15:01:18.066312+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488383"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important because a remote, unauthenticated attacker can trigger a denial of service in applications utilizing `netty-codec-haproxy`. By sending a specially crafted HAProxy message with a malformed SSL TLV header, an attacker can cause an `IndexOutOfBoundsException`, leading to unreleased memory and resource exhaustion. This can render the affected application unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44893"
},
{
"category": "external",
"summary": "RHBZ#2488383",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv"
}
],
"release_date": "2026-06-12T14:00:25.801000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message"
},
{
"cve": "CVE-2026-45205",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-14T12:00:57.045981+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477425"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Apache Commons Configuration allows a remote attacker to trigger a denial of service by providing specially crafted YAML input containing cycles. This can lead to an uncontrolled recursion and a StackOverflowError, impacting the availability of systems that process untrusted YAML configuration files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45205"
},
{
"category": "external",
"summary": "RHBZ#2477425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45205"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45205",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45205"
},
{
"category": "external",
"summary": "https://github.com/apache/commons-configuration/pull/634",
"url": "https://github.com/apache/commons-configuration/pull/634"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/q3q3j10ohcqhs6o0rg1v7kz6kk27vtkk",
"url": "https://lists.apache.org/thread/q3q3j10ohcqhs6o0rg1v7kz6kk27vtkk"
}
],
"release_date": "2026-05-14T11:22:43.908000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict Apache Commons Configuration to process only trusted YAML configuration files. Implement strict input validation for any YAML content originating from untrusted sources to prevent the parsing of malformed input with cyclical references. This operational control reduces the exposure to denial of service attacks.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input"
},
{
"cve": "CVE-2026-45416",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-12T15:01:45.671884+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488391"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in Netty is rated as Important. It allows a remote attacker to trigger a denial of service by sending a specially crafted TLS ClientHello message. The flaw arises from an eager, unbounded memory allocation during the TLS handshake, particularly when default configurations disable the maximum client hello length guard, leading to excessive resource consumption in affected Red Hat products utilizing Netty.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45416"
},
{
"category": "external",
"summary": "RHBZ#2488391",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh",
"url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
}
],
"release_date": "2026-06-12T14:10:05.585000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure applications utilizing Netty\u0027s `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application\u0027s documentation for details on configuring Netty\u0027s TLS handler. A restart of the affected application or service is required for the configuration changes to take effect.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake"
},
{
"cve": "CVE-2026-45736",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-05-15T16:00:55.786944+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477914"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in the `ws` WebSocket library for Node.js could lead to sensitive information disclosure. The flaw occurs when a `TypedArray` is specifically provided as the `reason` argument to the `websocket.close()` function, potentially exposing uninitialized memory. Red Hat products utilizing this library may be affected if their implementations allow for such a crafted `close()` call.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45736"
},
{
"category": "external",
"summary": "RHBZ#2477914",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477914"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45736",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45736"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45736",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45736"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086",
"url": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx",
"url": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx"
}
],
"release_date": "2026-05-15T14:53:57.263000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`"
},
{
"cve": "CVE-2026-48043",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-06-12T16:02:56.371830+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488442"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in netty-codec-http2, affecting Red Hat products that utilize HTTP/2 communication with decompression. A remote attacker can exploit a resource leak in the `DelegatingDecompressorFrameListener` by sending malformed HTTP/2 frames, potentially leading to an Out Of Memory Error and causing the Java Virtual Machine to terminate. This could disrupt service availability in affected deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48043"
},
{
"category": "external",
"summary": "RHBZ#2488442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48043"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j"
}
],
"release_date": "2026-06-12T14:39:52.498000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak"
},
{
"cve": "CVE-2026-48059",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-06-12T16:02:40.032749+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Netty HAProxy PROXY protocol v2 codec, which can lead to a denial of service. A remote attacker can trigger a memory leak by sending a specially crafted HAProxy PROXY protocol v2 header with deeply nested SSL TLV records, causing resource exhaustion in affected Red Hat products that utilize this codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48059"
},
{
"category": "external",
"summary": "RHBZ#2488437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j",
"url": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j"
}
],
"release_date": "2026-06-12T14:42:44.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers"
},
{
"cve": "CVE-2026-48779",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-16T22:01:24.571224+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2489661"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that consume excessive memory. Consequently, this leads to process termination and a denial of service (DoS) for the remote peer.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `ws` WebSocket library. A remote attacker can exploit this flaw by sending a high volume of small, fragmented data, leading to excessive memory consumption and subsequent process termination. This can result in service disruption for Red Hat products that utilize `ws` for WebSocket communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48779"
},
{
"category": "external",
"summary": "RHBZ#2489661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48779"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7",
"url": "https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53",
"url": "https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94",
"url": "https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8",
"url": "https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p",
"url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p"
}
],
"release_date": "2026-06-16T21:26:22.537000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments"
},
{
"cve": "CVE-2026-49362",
"discovery_date": "2026-05-15T17:32:50.558000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477945"
}
],
"notes": [
{
"category": "description",
"text": "Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATE_QUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-49362"
},
{
"category": "external",
"summary": "RHBZ#2477945",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477945"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-49362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49362"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49362",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49362"
}
],
"release_date": "2026-09-10T05:35:46.355000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation"
},
{
"cve": "CVE-2026-49363",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-06-25T04:34:49.677000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492627"
}
],
"notes": [
{
"category": "description",
"text": "A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBE_TOPOLOGY_V2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore(), no credential verification, no subject validation. An unauthenticated attacker can send a single 5-byte packet on the CORE protocol (via :8080 HTTP-upgrade in EAP or :61616 in AMQ Broker) to obtain the broker\u0027s nodeID (type-1 UUID embedding MAC address), internal hostname/IP, port numbers, connector configurations, and backup/scale-down group names. In clustered deployments, a persistent ClusterTopologyListener is registered that continuously pushes all topology changes to the unauthenticated client. This contrasts with the federation handler in the same file which was fixed via ARTEMIS-5928 (CVE-2026-27446). The leaked nodeID UUID seed directly enables session-name brute-force for REATTACH_SESSION session hijack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-49363"
},
{
"category": "external",
"summary": "RHBZ#2492627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-49363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49363"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49363",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49363"
}
],
"release_date": "2026-09-10T05:46:38.198000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "1. Remove Core protocol from internet-facing acceptors -- configure the protocols parameter to exclude Core protocol on any acceptor receiving untrusted connections. In EAP, the :8080 HTTP-upgrade acceptor supports Core by default; restricting to AMQP/STOMP/OpenWire prevents the attack entirely.\n\n2. Enable mutual TLS -- configure sslEnabled=true with needClientAuth=true on all Core protocol acceptors. TLS handshake failure occurs before any protocol-level packet can be sent.\n\n3. Disable HTTP-upgrade for Core protocol if not required -- remove the http-upgrade element from the Artemis acceptor configuration to eliminate the :8080 attack surface.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0"
},
{
"cve": "CVE-2026-49364",
"discovery_date": "2026-05-15T19:27:48.489000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2478013"
}
],
"notes": [
{
"category": "description",
"text": "Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-49364"
},
{
"category": "external",
"summary": "RHBZ#2478013",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478013"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-49364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49364"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49364",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49364"
}
],
"release_date": "2026-09-10T05:38:15.414000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof"
},
{
"cve": "CVE-2026-49432",
"cwe": {
"id": "CWE-839",
"name": "Numeric Range Comparison Without Minimum Check"
},
"discovery_date": "2026-06-30T11:02:19.680641+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache ActiveMQ. A remote, unauthenticated attacker can exploit an improper input validation vulnerability by sending a specially crafted message with a negative content-length to an exposed STOMP connector. This can lead to a denial of service (DoS) condition, either by consuming excessive memory and causing an Out-Of-Memory (OOM) error or by forcing the abnormal closure of affected connections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.activemq/activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-stomp: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability is in the Classic ActiveMQ STOMP connector\u0027s content-length validation, allowing an unauthenticated attacker to cause OOM via a negative content-length value. Apache ActiveMQ Artemis, which powers Red Hat AMQ Broker, has its own STOMP protocol implementation (artemis-stomp-protocol) that does not share this code path. The Classic STOMP connector is not exposed in Red Hat product deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-49432"
},
{
"category": "external",
"summary": "RHBZ#2494847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-49432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49432"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fsjb26605syqr8xks249h8gkp86t55d2",
"url": "https://lists.apache.org/thread/fsjb26605syqr8xks249h8gkp86t55d2"
}
],
"release_date": "2026-06-30T09:54:38.991000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.activemq/activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-stomp: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector"
},
{
"cve": "CVE-2026-49978",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-07-14T21:05:26.253019+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500695"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a `\u003ctemplate\u003e.content`. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-49978"
},
{
"category": "external",
"summary": "RHBZ#2500695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
},
{
"category": "external",
"summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
"url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
},
{
"category": "external",
"summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
"url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
},
{
"category": "external",
"summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
}
],
"release_date": "2026-07-14T20:02:46.263000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
},
{
"cve": "CVE-2026-50010",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-06-12T16:02:13.735675+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488429"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Netty that affects Red Hat products utilizing the `netty-handler` component, including various Red Hat AMQ, Enterprise Application Platform, and OpenShift offerings. The vulnerability arises when a Netty client is configured with a plain X.509 Trust Manager, leading to a bypass of hostname verification. This oversight allows a remote attacker to perform man-in-the-middle attacks by impersonating a legitimate server, potentially compromising sensitive data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50010"
},
{
"category": "external",
"summary": "RHBZ#2488429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9"
}
],
"release_date": "2026-06-12T14:50:43.151000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass"
},
{
"cve": "CVE-2026-50734",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-30T11:01:32.070962+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494841"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache ActiveMQ. An unauthenticated network attacker can exploit this vulnerability by sending a specially crafted WireFormatInfo frame with an excessively large size value. This unvalidated value causes the broker to attempt an oversized memory allocation during pre-authentication negotiation. Consequently, this can lead to an Out Of Memory (OOM) error, resulting in a Denial of Service (DoS) and crashing the broker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache ActiveMQ Client: Apache ActiveMQ: Apache ActiveMQ All: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache ActiveMQ Classic\u0027s OpenWire protocol handling. An unauthenticated remote attacker can crash the broker by sending a crafted WireFormatInfo frame with a malicious oversized value during pre-authentication protocol negotiation, causing an Out of Memory condition. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis, but its OpenWire protocol support delegates wire format negotiation to Classic ActiveMQ\u0027s activemq-client code, which is vulnerable to this attack on the OpenWire listener port.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50734"
},
{
"category": "external",
"summary": "RHBZ#2494841",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494841"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50734"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/nxso951fnvf72qf9m475mpz4yf931xk0",
"url": "https://lists.apache.org/thread/nxso951fnvf72qf9m475mpz4yf931xk0"
}
],
"release_date": "2026-06-30T09:53:03.435000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache ActiveMQ Client: Apache ActiveMQ: Apache ActiveMQ All: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame"
},
{
"cve": "CVE-2026-53916",
"cwe": {
"id": "CWE-789",
"name": "Memory Allocation with Excessive Size Value"
},
"discovery_date": "2026-06-30T11:02:10.860929+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494846"
}
],
"notes": [
{
"category": "description",
"text": "Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.\n\n\nAn unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit,\u00a0exhausting\u00a0the JVM heap. \nThis issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "activemq-stomp: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability is in the Classic ActiveMQ STOMP NIO codec, which does not limit the size of header byte buffering, allowing an unauthenticated attacker to exhaust JVM heap memory. Apache ActiveMQ Artemis, which powers Red Hat AMQ Broker, has its own STOMP protocol implementation (artemis-stomp-protocol) that does not share this code path. The Classic STOMP NIO codec is not exposed in Red Hat product deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53916"
},
{
"category": "external",
"summary": "RHBZ#2494846",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494846"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53916",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53916"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53916",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53916"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/07hjsj88hqgsb7vvg6ttsj56ts9vjs5n",
"url": "https://lists.apache.org/thread/07hjsj88hqgsb7vvg6ttsj56ts9vjs5n"
}
],
"release_date": "2026-06-30T09:49:55.655000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "activemq-stomp: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-54513",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2026-06-23T22:01:34.437620+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492010"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in `jackson-databind` allows for a security bypass, enabling arbitrary code execution. The vulnerability arises from insufficient validation of array component types by `BasicPolymorphicTypeValidator`, which permits deserialization of unallowlisted types when processing untrusted input. This bypass of type validation can lead to a complete system compromise, affecting confidentiality, integrity, and availability in Red Hat products utilizing `jackson-databind` for data processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54513"
},
{
"category": "external",
"summary": "RHBZ#2492010",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54513"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5",
"url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e",
"url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5981",
"url": "https://github.com/FasterXML/jackson-databind/issues/5981"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5983",
"url": "https://github.com/FasterXML/jackson-databind/issues/5983"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5984",
"url": "https://github.com/FasterXML/jackson-databind/pull/5984"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"
}
],
"release_date": "2026-06-23T20:53:52.543000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application\u2019s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change.\n\nAs an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution"
},
{
"cve": "CVE-2026-55831",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-21T00:02:57.305291+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503103"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service (DoS) due to heap growth and increased CPU usage.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in Netty\u0027s SPDY SETTINGS decoder, allowing a remote unauthenticated attacker to exhaust system resources. By sending a specially crafted SPDY/3.1 SETTINGS frame, an attacker can cause excessive memory allocation and CPU usage, leading to a denial of service. This vulnerability has a low attack complexity and requires no user interaction or privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55831"
},
{
"category": "external",
"summary": "RHBZ#2503103",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503103"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"
}
],
"release_date": "2026-07-20T23:00:31.859000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing"
},
{
"cve": "CVE-2026-55833",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-21T00:01:25.203265+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to excessive CPU usage and memory allocation. This can result in a denial of service (DoS) due to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY header decoding. A remote, unauthenticated attacker can send a small, compressed SPDY header block that, during decompression, expands significantly beyond configured limits. This leads to excessive CPU and memory consumption, potentially causing resource exhaustion and service unavailability in affected Red Hat products that utilize Netty with SPDY.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55833"
},
{
"category": "external",
"summary": "RHBZ#2503101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c",
"url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"
}
],
"release_date": "2026-07-20T23:18:07.893000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification"
},
{
"cve": "CVE-2026-55851",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-21T22:43:00.311516+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505698"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service (DoS) due to memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service vulnerability in the Netty `codec-haproxy` module. A remote attacker can send a specially crafted PROXY protocol v2 message, causing unbounded memory accumulation and exhausting direct memory, leading to service unavailability. This impact is significant for applications that process PROXY protocol v2 messages using the affected Netty component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55851"
},
{
"category": "external",
"summary": "RHBZ#2505698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505698"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55851",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55851"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5",
"url": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5"
}
],
"release_date": "2026-07-21T21:22:34.879000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message"
},
{
"cve": "CVE-2026-56745",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-21T22:52:47.296001+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505911"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty\u0027s SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY-to-HTTP codec, affecting Red Hat products that utilize vulnerable versions of Netty. A remote, unauthenticated attacker can exploit a memory leak in the `SpdyHttpDecoder` by sending specially crafted `SYN_STREAM` frames, leading to native memory exhaustion and a denial of service for the affected system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56745"
},
{
"category": "external",
"summary": "RHBZ#2505911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505911"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56745"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq",
"url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"
}
],
"release_date": "2026-07-21T21:31:25.307000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec"
},
{
"cve": "CVE-2026-56746",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-21T22:30:30.983812+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505422"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the `CorsHandler` component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the backend application. This could lead to a compromise of data integrity by allowing unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat ships Netty\u0027s netty-codec-http component in multiple products. The CorsHandler shortCircuit() feature, when enabled, is intended to reject unauthorized cross-origin requests before they reach the application. Due to a logical operator error in origin validation, requests with a null Origin header bypass this protection entirely. Upgrade to Netty 4.1.136.Final or 4.2.16.Final to resolve this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56746"
},
{
"category": "external",
"summary": "RHBZ#2505422",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505422"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56746"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"
}
],
"release_date": "2026-07-21T21:36:18.627000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "If CORS short-circuit functionality is not required, disable the shortCircuit() configuration in the CorsHandler. Alternatively, implement application-level origin validation to reject requests with null Origin headers. A web application firewall (WAF) can also be configured to block requests with null or missing Origin headers.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header"
},
{
"cve": "CVE-2026-56819",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"discovery_date": "2026-07-21T23:03:36.448652+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505980"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing the application to crash and resulting in a Denial of Service (DoS). The issue occurs because the framework fails to release retained memory buffers when processing DATA frames for a stream whose decompressor has already been closed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Netty\u0027s HTTP/2 codec, which could lead to a denial of service. Red Hat products utilizing netty-codec-http2 with HTTP/2 content decompression enabled are susceptible to memory exhaustion when processing specially crafted HTTP/2 DATA frames. This allows a remote attacker to leak memory buffers, eventually exhausting available memory and impacting system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56819"
},
{
"category": "external",
"summary": "RHBZ#2505980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505980"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56819",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56819"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56819",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56819"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972",
"url": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"
}
],
"release_date": "2026-07-21T22:11:17.470000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak"
},
{
"cve": "CVE-2026-57822",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2495823"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray() method\nuses ObjectInputStream.readObject() to deserialize CompositeData from Base64-encoded\nserialized objects in management message bodies sent to the activemq.management\naddress. While the deserialization is protected by an allowlist\n(java.util,java.lang,javax.management) that blocks RCE gadget chains, an\nauthenticated attacker with the MANAGE role can craft a deserialization bomb using\ndeeply nested java.util.HashSet/HashMap structures to exhaust CPU/memory and crash\nthe broker JVM, causing denial of service for all connected clients.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57822"
},
{
"category": "external",
"summary": "RHBZ#2495823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495823"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57822"
},
{
"category": "external",
"summary": "https://github.com/apache/activemq-artemis/blob/2.16.0/artemis-core-client/src/main/java/org/apache/activemq/artemis/api/core/JsonUtil.java",
"url": "https://github.com/apache/activemq-artemis/blob/2.16.0/artemis-core-client/src/main/java/org/apache/activemq/artemis/api/core/JsonUtil.java"
}
],
"release_date": "2026-09-10T05:47:50.569000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Restrict MANAGE role access: ensure only trusted administrative accounts have the manage permission on the activemq.management address. Review security-setting configurations in standalone-full.xml (EAP) or broker.xml (AMQ Broker) to confirm management address role assignments follow least-privilege principles. Additionally, restrict network access to messaging ports (default 61616) so that management operations are only accessible from administrative networks.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address"
},
{
"cve": "CVE-2026-57967",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-05-21T21:25:08.084000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480638"
}
],
"notes": [
{
"category": "description",
"text": "in Apache Artemis, the REATTACH_SESSION handler performs zero authentication \u2014 it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker\u0027s connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "artemis-server: Apache Artemis \u2014 session hijack via missing authentication",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57967"
},
{
"category": "external",
"summary": "RHBZ#2480638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57967",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57967"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57967",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57967"
}
],
"release_date": "2026-09-10T05:40:15.760000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "artemis-server: Apache Artemis \u2014 session hijack via missing authentication"
},
{
"cve": "CVE-2026-59869",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-07-08T16:01:38.408322+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498122"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59869"
},
{
"category": "external",
"summary": "RHBZ#2498122",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
"url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
"url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
}
],
"release_date": "2026-07-08T15:15:54.675000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
},
{
"cve": "CVE-2026-59873",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-08T16:01:31.576716+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498120"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tar: node-tar: Denial of Service via crafted gzip bomb",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library\u0027s archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59873"
},
{
"category": "external",
"summary": "RHBZ#2498120",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59873",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59873"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3",
"url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19",
"url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
}
],
"release_date": "2026-07-08T15:22:40.077000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tar: node-tar: Denial of Service via crafted gzip bomb"
},
{
"cve": "CVE-2026-59874",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-07-08T16:01:09.952291+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498116"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tar: Node-tar: Denial of Service via malformed tar archive header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. This can impact the availability of services relying on node-tar for archive manipulation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59874"
},
{
"category": "external",
"summary": "RHBZ#2498116",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59874"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5",
"url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18",
"url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
},
{
"category": "external",
"summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
}
],
"release_date": "2026-07-08T15:23:47.527000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tar: Node-tar: Denial of Service via malformed tar archive header"
},
{
"cve": "CVE-2026-59899",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507482"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Netty\u0027s HTTP decoder, which could lead to a denial of service. Red Hat products utilizing `netty-codec-http` are susceptible to memory exhaustion when processing specially crafted, highly compressed HTTP payloads. This allows a remote attacker to trigger excessive memory allocation, impacting system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59899"
},
{
"category": "external",
"summary": "RHBZ#2507482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507482"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59899"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww",
"url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"
},
{
"category": "external",
"summary": "https://netty.io/news/2026/07/09/4-1-136-Final.html",
"url": "https://netty.io/news/2026/07/09/4-1-136-Final.html"
}
],
"release_date": "2026-07-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)"
},
{
"cve": "CVE-2026-62243",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-22T12:51:41.376413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521309"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship io.netty:netty-handler as a transitive dependency across multiple middleware and platform products. While the CVSS score reflects the severity of a successful exploit \u2014 full confidentiality compromise of TLS-protected traffic without authentication \u2014 the vulnerable code path requires three conditions simultaneously: explicit OpenSSL provider configuration, a plain X509TrustManager, and a Java 25+ runtime. Most Red Hat product deployments use the default JDK SSL provider and currently run on Java 21 LTS, making the vulnerable configuration uncommon in practice.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-62243"
},
{
"category": "external",
"summary": "RHBZ#2521309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-62243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c",
"url": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass",
"url": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass"
}
],
"release_date": "2026-08-22T12:26:43.072000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). \n\nThe following mitigations can reduce exposure without applying a patch:\n\n1) Use the default JDK SSL provider \u2014 Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden.\n\n2) Use X509ExtendedTrustManager \u2014 If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic.\n\n3) Run on Java 24 or earlier \u2014 The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration"
},
{
"cve": "CVE-2026-66257",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T06:01:13.741100+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache Qpid Proton-J, allowing a pre-authentication attacker to exhaust system resources through unbounded symbol value caching. This can lead to service unavailability in Red Hat products utilizing affected versions of Proton-J that expose a network endpoint. The vulnerability\u0027s impact is significant due to the potential for unauthenticated remote attackers to disrupt service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66257"
},
{
"category": "external",
"summary": "RHBZ#2511326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66257"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm",
"url": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm"
}
],
"release_date": "2026-08-05T05:18:01.606000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching"
},
{
"cve": "CVE-2026-66273",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T06:01:00.913036+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Apache Qpid Proton-J allows a remote, unauthenticated attacker to cause a denial of service. By sending specially crafted messages, an attacker can trigger excessive memory allocation, leading to resource exhaustion in applications utilizing the library within Red Hat products such as AMQ, Quarkus, Camel, and EAP.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66273"
},
{
"category": "external",
"summary": "RHBZ#2511322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66273"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh",
"url": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh"
}
],
"release_date": "2026-08-05T05:23:31.964000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation"
},
{
"cve": "CVE-2026-66274",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T07:00:53.637061+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important as a remote, unauthenticated attacker can trigger a denial of service in Apache Qpid Proton-J. By sending specially crafted messages with unbounded type nesting, an attacker can cause a StackOverflowError, leading to service unavailability without requiring prior authentication or complex attack prerequisites.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66274"
},
{
"category": "external",
"summary": "RHBZ#2511337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66274"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h",
"url": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h"
}
],
"release_date": "2026-08-05T05:29:44.681000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services utilizing Apache Qpid Proton-J to trusted clients and networks only. Implement firewall rules to limit inbound connections to the specific ports used by these services. This operational control reduces the attack surface by preventing untrusted external access, but may impact legitimate client connectivity if not carefully configured.",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting"
},
{
"cve": "CVE-2026-67593",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-08-03T05:16:39.050000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510277"
}
],
"notes": [
{
"category": "description",
"text": "An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled (default). The processRemoveSubscription() method executes pre-authentication with no authorization check, and uses the internal destroyQueue(SimpleString) overload that skips security entirely. Default queues DLQ and ExpiryQueue are trivially targetable. This is unfixed in all Artemis versions through 2.55.0.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67593"
},
{
"category": "external",
"summary": "RHBZ#2510277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67593",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67593"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67593",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67593"
}
],
"release_date": "2026-09-10T05:32:43.600000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"category": "workaround",
"details": "1. Remove OpenWire from acceptors \u2014 edit broker.xml, remove OPENWIRE from protocols parameter\n2. Firewall \u2014 restrict port 61616 to trusted clients if OpenWire cannot be disabled\n3. Monitor \u2014 watch for \"AMQ601069: destroyed queue: \u003cname\u003e\" in broker logs",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.14.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-10T16:34:06+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.14.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.14.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
}
]
}
SUSE-SU-2026:1639-1
Vulnerability from csaf_suse - Published: 2026-04-28 11:10 - Updated: 2026-04-28 11:10Summary
Security update for bouncycastle
Severity
Important
Notes
Title of the patch: Security update for bouncycastle
Description of the patch: This update for bouncycastle fixes the following issues:
Update to version 1.84.
Security issues fixed:
- CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).
- CVE-2026-0636: LDAP injection in LDAPStoreHelper.java leads to information disclosure (bsc#1262226).
- CVE-2026-3505: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).
- CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).
- CVE-2026-5598: non-constant time comparisons risks private key leakage in FrodoKEM (bsc#1262227).
Other updates and bugfixes:
- Version 1.84:
- In line with JVM changes, KEM support has been backported to
Java 17.
- BCJSSE: Configurable (client) early key_share groups via
BCSSLParameters.earlyKeyShares or
'org.bouncycastle.jsse.client.earlyKeyShares' system property.
- BCJSSE: Support for curveSM2MLKEM768 hybrid NamedGroup in TLS
1.3 per draft-yang-tls-hybrid-sm2-mlkem-03.
- BCJSSE: Log when default cipher suites are disabled.
- BCJSSE: Experimental support for ShangMi crypto in TLS 1.3 per
RFC 8998 (not enabled by default).
- CMS: Added CMSAuthEnvelopedDataStreamGenerator.open taking an
explicit content type.
- HKDF: Provider support for HKDFParameterSpec.Expand.
- Added initial support for RFC 9380 (Hashing to Elliptic Curves);
see org.bouncycastle.crypto.hash2curve .
- PKCS12: Added default max iteration count of 5,000,000 (configurable
via 'org.bouncycastle.pkcs12.max_it_count' property).
- TLS: Use javax.crypto.KEM API (when available) to access ML-KEM
implementation (incl. hybrids).
- A new KeyStore, PKCS12-PBMAC1, has been added which defaults to
using PBMAC1 and supports RFC 9879.
- A new property 'org.bouncycastle.asn1.max_cons_depth' has been added
to allow setting of the maximum nesting for SETs/SEQUENCESs in ASN.1.
Default is 32.
- A new property 'org.bouncycastle.asn1.max_limit' has been added
to allow setting of the stream size of ASN.1 encodings. The value can
be either in bytes, or appended with k (1 kilobyte blocks), m (1
megabyte blocks), or g (1 gigabyte blocks).
- Added NTRU+ support to the lightweight PQC API and the BCPQC provider.
- Added SM4 key wrap/unwrap mode, SM2 key exchange, and logging to SM2Signer.
- OpenPGP: Added encryption-key filtering by purpose, a new OpenPGPKey
constructor, KeyPassphraseProvider-based passphrase change, wildcard
(anonymous) recipient handling, and Web-of-Trust methods for
third-party signature chains and delegations.
- CMSSignedDataStreamGenerator can now support the generation of DER/DL
encoded SignedData objects (note memory restrictions still apply).
- It is now possible to add extra digest alorithm IDs to
CMSSignedDataStreamGenerator when required.
- Random numbers being generated for DSTU4145 signature calculations
were 1 bit shorter than they could be. The code has been corrected
to allow the generated numbers to occupy the full numeric range available.
- HKDF implementation has been corrected to use multiple IKMs if available.
- CompositePublic/PrivateKey builders had an issue identifying brainpool
and EdDSA curves from the algorithm names due to an error in the OID
mapping table. This has been fixed.
- S/MIME: Fix AuthEnveloped support for AES192/GCM and AES256/GCM.
- CMS: Use implicit tag for AuthEnvelopedData.authEncryptedContentInfo.encryptedContent.
- Fixed Strings.split to handle delimiters at position 0.
- Fixed FrodoKEM error sampling to be constant-time.
- Fixed PKIXNameConstraintValidator to treat a DNS name as intersecting itself.
- Fixed PKCS12 key stores not calling getInstance with the original provider
(which was forcing provider registration).
- A resource leak due to the SMIMESigned constructor leaving background
threads hanging on MessagingException has been fixed.
- OpenPGP: Fixed an issue where a custom signature creation time was
ignored when generating message signatures.
- OpenPGP: Fixed SKESK encoding for direct-S2K-encrypted messages.
- Version 1.83:
- Attempting to check a password on a stripped PGP would throw an
exception. Checking the password on such a key will now always
return false.
- Fixed an issue in KangarooTwelve where premature absorption caused
erroneous 168-byte padding; absorption is now delayed so correct
final-byte padding is applied.
- BCJSSE: Fix supported_versions creation for renegotiation handshake.
- (D)TLS: Reneg info now oly offered with pre-1.3.
- A generic 'COMPOSITE' algorithm name has been added as a JCA
Signature algorithm. The algorithm will identify the composite
signature to use from the composite key passed in.
- The composite signatures implementation has been updated to the
final draft and now follows the submitted standard.
- Support for the generation and use as trust anchors has been added
for certificate signatures with id-alg-unsigned as the signature type.
- Support for CMP direct POP for encryption keys using
challenge/response has been added to the CMP/CRMF APIs.
- Support for SupportedCurves attribute to the BC provider
- BCJSSE: Added support for SLH-DSA signature schemes in TLS 1.3 per
draft-reddy-tls-slhdsa-01.
- Support has been added for the Java 25 KDF API (current algorithms,
PBKDF2, SCRYPT, and HKDF).
- Support for composite signatures is now included in CMS and timestamping.
- It is now possible to disable the Lenstra check in RSA where the public
key is not available via the system/security property
'org.bouncycastle.rsa.no_lenstra_check'.
- Version 1.82:
- SNOVA and MAYO are now correctly added to the JCA provider module-info file.
- TLS: Avoid nonce reuse error in JCE AEAD workaround for pre-Java7.
- BCJSSE: Session binding map is now shared across all stages of the
session lifecycle (SunJSSE compatibility).
- The CMCEPrivateKeyParameters#reconstructPublicKey method was returning
an empty byte array. It now returns an encoding of the public key.
- CBZip2InputStream no longer auto-closes at end-of-contents.
- The BC CertPath implementation was eliminating certificates on the
bases of the Key-ID. This is not in accordance with RFC 4158.
- Support for the previous set of libOQS Falcon OIDs has been restored.
- The BC CipherInputStream could throw an exception if asked to handle an
AEAD stream consisting of the MAC only.
- Some KeyAgreement classes were missing in the Java 11 class hierarchy.
- Fix typo in a constant name in the HPKE class and deprecate the old constant.
- Fuzzing analysis has been done on the OpenPGP API and additional code
has been added to prevent escaping exceptions.
- SHA3Digest, CSHAKE, TupleHash, KMAC now provide support for Memoable
and EncodableService.
- BCJSSE: Added support for integrity-only cipher suites in TLS 1.3 per RFC 9150.
- BCJSSE: Added support for system properties 'jdk.tls.{client,server}.maxInboundCertificateChainLength'
- BCJSSE: Added support for ML-DSA signature schemes in TLS 1.3 per draft-ietf-tls-mldsa-00.
- The Composite post-quantum signatures implementation has been updated to
the latest draft (07) draft-ietf-lamps-pq-composite-sigs.
- '_PREHASH' implementations are now provided for all composite signatures
to allow the hash of the date to be used instead of the actual data in
signature calculation.
- The gradle build can now be used to generate an Bill of Materials (BOM) file.
- It is now possible to configure the SignerInfoVerifierBuilder used by the
SignedMailValidator class.
- The Ascon family of algorithms has been updated with the latest published changes.
- Composite signature keys can now be constructed from the individual keys of
the algorithms composing the composite.
- PGPSecretKey, PGPSignatureGenerator now support version 6.
- Further optimisation work has been done on ML-KEM public key validation.
- Zeroization of passwords in the JCA PKCS12 key store has been improved.
- The 'org.bouncycastle.drbg.effective_256bits_entropy' property has been
added for platforms where the entropy source is not producing 1 full bit
of entropy per bit and additional bits are required (default value 282).
- OpenPGPKeyGenerator now allows for the use of empty UserIDs (version 4 compatibility).
- The HQC KEM has been updated with the latest draft updates.
- The legacy post-quantum package has now been removed.
- Version 1.81:
- A potention NullPointerException in the KEM KDF KemUtil class
has been removed.
- Overlapping input/output buffers in doFinal could result in
data corruption.
- Fixed Grain-128AEAD decryption incorrectly handle MAC verification.
- Add configurable header validation to prevent malicious header
injection in PGP cleartext signed messages; Fix signature packet
encoding issues in PGPSignature.join() and embedded signatures
while phasing out legacy format.
- Fixed ParallelHash initialization stall when using block size B=0.
- The PRF from the PBKDF2 function was been lost when PBMAC1 was
initialized from protectionAlgorithm. This has been fixed.
- The lowlevel DigestFactory was cloning MD5 when being asked
to clone SHA1.
- XWing implementation updated to draft-connolly-cfrg-xwing-kem/07/
- Further support has been added for generation and use of PGP V6 keys
- Additional validation has been added for armored headers in Cleartext
Signed Messages.
- The PQC signature algorithm proposal Mayo has been added to the
low-level API and the BCPQC provider.
- The PQC signature algorithm proposal Snova has been added to the
low-level API and the BCPQC provider.
- Support for ChaCha20-Poly1305 has been added to the CMS/SMIME APIs.
- The Falcon implementation has been updated to the latest draft.
- Support has been added for generating keys which encode as seed-only
and expanded-key-only for ML-KEM and ML-DSA private keys.
- Private key encoding of ML-DSA and ML-KEM private keys now follows
the latest IETF draft.
- The Ascon family of algorithms has been updated to the initial draft
of SP 800-232. Some additional optimisation work has been done.
- Support for ML-DSA's external-mu calculation and signing has been
added to the BC provider.
- CMS now supports ML-DSA for SignedData generation.
- Introduce high-level OpenPGP API for message creation/consumption
and certificate evaluation.
- Added JDK21 KEM API implementation for HQC algorithm.
- BCJSSE: Strip trailing dot from hostname for SNI, endpointID checks.
- BCJSSE: Draft support for ML-KEM updated (draft-connolly-tls-mlkem-key-agreement-05).
- BCJSSE: Draft support for hybrid ECDHE-MLKEM (draft-ietf-tls-ecdhe-mlkem-00).
- BCJSSE: Optionally prefer TLS 1.3 server's supported_groups order
(BCSSLParameters.useNamedGroupsOrder).
- Version 1.80:
- A splitting issue for ML-KEM led to an incorrect size for kemct
in KEMRecipientInfos. This has been fixed.
- The PKCS12 KeyStore has been adjusted to prevent accidental doubling
of the Oracle trusted certificate attribute (results in an IOException
when used with the JVM PKCS12 implementation).
- The SignerInfoGenerator copy constructor was ignoring the certHolder field.
- The getAlgorithm() method return value for a CompositePrivateKey was
not consistent with the corresponding getAlgorithm() return value for
the CompositePrivateKey. This has been fixed.
- The international property files were missing from the bcjmail distribution.
- Issues with ElephantEngine failing on processing large/multi-block messages
have been addressed.
- GCFB mode now fully resets on a reset.
- The lightweight algorithm contestants: Elephant, ISAP, PhotonBeetle,
Xoodyak now support the use of the AEADParameters class and provide
accurate update/doFinal output lengths.
- An unnecessary downcast in CertPathValidatorUtilities was resulting
in the ignoring of URLs for FTP based CRLs.
- A regression in the OpenPGP API could cause NoSuchAlgorithmException
to be thrown when attempting to use SHA-256 in some contexts.
- EtsiTs1029411TypesAuthorization was missing an extension field.
- Interoperability issues with single depth LMS keys have been addressed.
- CompositeSignatures now updated to draft-ietf-lamps-pq-composite-sigs-03.
- ML-KEM, ML-DSA, SLH-DSA, and Composite private keys now use raw encodings
as per the latest drafts from IETF 121: draft-ietf-lamps-kyber-certificates-06,
draft-ietf-lamps-dilithium-certificates-05, and draft-ietf-lamps-x509-slhdsa.
- Initial support has been added for RFC 9579 PBMAC1 in the PKCS API.
- Support has been added for EC-JPAKE to the lightweight API.
- Support has been added for the direct construction of S/MIME AuthEnvelopedData
objects, via the SMIMEAuthEnvelopedData class.
- An override 'org.bouncycastle.asn1.allow_wrong_oid_enc' property has been
added to disable new OID encoding checks (use with caution).
- Support has been added for the PBEParemeterSpec.getParameterSpec()
method where supported by the JVM.
- ML-DSA/SLH-DSA now return null for Signature.getParameters() if no context
is provided. This allows the algorithms to be used with the existing Java key tool.
- HQC has been updated to reflect the reference implementation released on 2024-10-30.
- Support has been added to the low-level APIs for the OASIS Shamir Secret
Splitting algorithms.
- BCJSSE: System property 'org.bouncycastle.jsse.fips.allowGCMCiphersIn12'
no longer used. FIPS TLS 1.2 GCM suites can now be enabled according to
JcaTlsCrypto#getFipsGCMNonceGeneratorFactory (see JavaDoc for details) if
done in alignment with FIPS requirements.
- Support has been added for OpenPGP V6 PKESK and message encryption.
- PGPSecretKey.copyWithNewPassword() now includes AEAD support.
- The ASCON family of algorithms have been updated in accordance with the
published FIPS SP 800-232 draft.
Patchnames: SUSE-2026-1639,SUSE-SLE-Module-Development-Tools-15-SP7-2026-1639,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1639,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1639,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1639,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1639
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.6 (High)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
8.6 (High)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
24 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for bouncycastle",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for bouncycastle fixes the following issues:\n\nUpdate to version 1.84.\n\nSecurity issues fixed:\n\n- CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).\n- CVE-2026-0636: LDAP injection in LDAPStoreHelper.java leads to information disclosure (bsc#1262226).\n- CVE-2026-3505: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).\n- CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).\n- CVE-2026-5598: non-constant time comparisons risks private key leakage in FrodoKEM (bsc#1262227).\n\nOther updates and bugfixes:\n\n- Version 1.84:\n - In line with JVM changes, KEM support has been backported to\n Java 17.\n - BCJSSE: Configurable (client) early key_share groups via\n BCSSLParameters.earlyKeyShares or\n \u0027org.bouncycastle.jsse.client.earlyKeyShares\u0027 system property.\n - BCJSSE: Support for curveSM2MLKEM768 hybrid NamedGroup in TLS\n 1.3 per draft-yang-tls-hybrid-sm2-mlkem-03.\n - BCJSSE: Log when default cipher suites are disabled.\n - BCJSSE: Experimental support for ShangMi crypto in TLS 1.3 per\n RFC 8998 (not enabled by default).\n - CMS: Added CMSAuthEnvelopedDataStreamGenerator.open taking an\n explicit content type.\n - HKDF: Provider support for HKDFParameterSpec.Expand.\n - Added initial support for RFC 9380 (Hashing to Elliptic Curves);\n see org.bouncycastle.crypto.hash2curve .\n - PKCS12: Added default max iteration count of 5,000,000 (configurable\n via \u0027org.bouncycastle.pkcs12.max_it_count\u0027 property).\n - TLS: Use javax.crypto.KEM API (when available) to access ML-KEM\n implementation (incl. hybrids).\n - A new KeyStore, PKCS12-PBMAC1, has been added which defaults to\n using PBMAC1 and supports RFC 9879.\n - A new property \u0027org.bouncycastle.asn1.max_cons_depth\u0027 has been added\n to allow setting of the maximum nesting for SETs/SEQUENCESs in ASN.1.\n Default is 32.\n - A new property \u0027org.bouncycastle.asn1.max_limit\u0027 has been added\n to allow setting of the stream size of ASN.1 encodings. The value can\n be either in bytes, or appended with k (1 kilobyte blocks), m (1\n megabyte blocks), or g (1 gigabyte blocks).\n - Added NTRU+ support to the lightweight PQC API and the BCPQC provider.\n - Added SM4 key wrap/unwrap mode, SM2 key exchange, and logging to SM2Signer.\n - OpenPGP: Added encryption-key filtering by purpose, a new OpenPGPKey\n constructor, KeyPassphraseProvider-based passphrase change, wildcard\n (anonymous) recipient handling, and Web-of-Trust methods for\n third-party signature chains and delegations.\n - CMSSignedDataStreamGenerator can now support the generation of DER/DL\n encoded SignedData objects (note memory restrictions still apply).\n - It is now possible to add extra digest alorithm IDs to\n CMSSignedDataStreamGenerator when required.\n - Random numbers being generated for DSTU4145 signature calculations\n were 1 bit shorter than they could be. The code has been corrected\n to allow the generated numbers to occupy the full numeric range available.\n - HKDF implementation has been corrected to use multiple IKMs if available.\n - CompositePublic/PrivateKey builders had an issue identifying brainpool\n and EdDSA curves from the algorithm names due to an error in the OID\n mapping table. This has been fixed.\n - S/MIME: Fix AuthEnveloped support for AES192/GCM and AES256/GCM.\n - CMS: Use implicit tag for AuthEnvelopedData.authEncryptedContentInfo.encryptedContent.\n - Fixed Strings.split to handle delimiters at position 0.\n - Fixed FrodoKEM error sampling to be constant-time.\n - Fixed PKIXNameConstraintValidator to treat a DNS name as intersecting itself.\n - Fixed PKCS12 key stores not calling getInstance with the original provider\n (which was forcing provider registration).\n - A resource leak due to the SMIMESigned constructor leaving background\n threads hanging on MessagingException has been fixed.\n - OpenPGP: Fixed an issue where a custom signature creation time was\n ignored when generating message signatures.\n - OpenPGP: Fixed SKESK encoding for direct-S2K-encrypted messages.\n\n- Version 1.83:\n - Attempting to check a password on a stripped PGP would throw an\n exception. Checking the password on such a key will now always\n return false.\n - Fixed an issue in KangarooTwelve where premature absorption caused\n erroneous 168-byte padding; absorption is now delayed so correct\n final-byte padding is applied.\n - BCJSSE: Fix supported_versions creation for renegotiation handshake.\n - (D)TLS: Reneg info now oly offered with pre-1.3.\n - A generic \u0027COMPOSITE\u0027 algorithm name has been added as a JCA\n Signature algorithm. The algorithm will identify the composite\n signature to use from the composite key passed in.\n - The composite signatures implementation has been updated to the\n final draft and now follows the submitted standard.\n - Support for the generation and use as trust anchors has been added\n for certificate signatures with id-alg-unsigned as the signature type.\n - Support for CMP direct POP for encryption keys using\n challenge/response has been added to the CMP/CRMF APIs.\n - Support for SupportedCurves attribute to the BC provider\n - BCJSSE: Added support for SLH-DSA signature schemes in TLS 1.3 per\n draft-reddy-tls-slhdsa-01.\n - Support has been added for the Java 25 KDF API (current algorithms,\n PBKDF2, SCRYPT, and HKDF).\n - Support for composite signatures is now included in CMS and timestamping.\n - It is now possible to disable the Lenstra check in RSA where the public\n key is not available via the system/security property\n \u0027org.bouncycastle.rsa.no_lenstra_check\u0027.\n\n- Version 1.82:\n - SNOVA and MAYO are now correctly added to the JCA provider module-info file.\n - TLS: Avoid nonce reuse error in JCE AEAD workaround for pre-Java7.\n - BCJSSE: Session binding map is now shared across all stages of the\n session lifecycle (SunJSSE compatibility).\n - The CMCEPrivateKeyParameters#reconstructPublicKey method was returning\n an empty byte array. It now returns an encoding of the public key.\n - CBZip2InputStream no longer auto-closes at end-of-contents.\n - The BC CertPath implementation was eliminating certificates on the\n bases of the Key-ID. This is not in accordance with RFC 4158.\n - Support for the previous set of libOQS Falcon OIDs has been restored.\n - The BC CipherInputStream could throw an exception if asked to handle an\n AEAD stream consisting of the MAC only.\n - Some KeyAgreement classes were missing in the Java 11 class hierarchy.\n - Fix typo in a constant name in the HPKE class and deprecate the old constant.\n - Fuzzing analysis has been done on the OpenPGP API and additional code\n has been added to prevent escaping exceptions.\n - SHA3Digest, CSHAKE, TupleHash, KMAC now provide support for Memoable\n and EncodableService.\n - BCJSSE: Added support for integrity-only cipher suites in TLS 1.3 per RFC 9150.\n - BCJSSE: Added support for system properties \u0027jdk.tls.{client,server}.maxInboundCertificateChainLength\u0027\n - BCJSSE: Added support for ML-DSA signature schemes in TLS 1.3 per draft-ietf-tls-mldsa-00.\n - The Composite post-quantum signatures implementation has been updated to\n the latest draft (07) draft-ietf-lamps-pq-composite-sigs.\n - \u0027_PREHASH\u0027 implementations are now provided for all composite signatures\n to allow the hash of the date to be used instead of the actual data in\n signature calculation.\n - The gradle build can now be used to generate an Bill of Materials (BOM) file.\n - It is now possible to configure the SignerInfoVerifierBuilder used by the\n SignedMailValidator class.\n - The Ascon family of algorithms has been updated with the latest published changes.\n - Composite signature keys can now be constructed from the individual keys of\n the algorithms composing the composite.\n - PGPSecretKey, PGPSignatureGenerator now support version 6.\n - Further optimisation work has been done on ML-KEM public key validation.\n - Zeroization of passwords in the JCA PKCS12 key store has been improved.\n - The \u0027org.bouncycastle.drbg.effective_256bits_entropy\u0027 property has been\n added for platforms where the entropy source is not producing 1 full bit\n of entropy per bit and additional bits are required (default value 282).\n - OpenPGPKeyGenerator now allows for the use of empty UserIDs (version 4 compatibility).\n - The HQC KEM has been updated with the latest draft updates.\n - The legacy post-quantum package has now been removed.\n\n- Version 1.81:\n - A potention NullPointerException in the KEM KDF KemUtil class\n has been removed.\n - Overlapping input/output buffers in doFinal could result in\n data corruption.\n - Fixed Grain-128AEAD decryption incorrectly handle MAC verification.\n - Add configurable header validation to prevent malicious header\n injection in PGP cleartext signed messages; Fix signature packet\n encoding issues in PGPSignature.join() and embedded signatures\n while phasing out legacy format.\n - Fixed ParallelHash initialization stall when using block size B=0.\n - The PRF from the PBKDF2 function was been lost when PBMAC1 was\n initialized from protectionAlgorithm. This has been fixed.\n - The lowlevel DigestFactory was cloning MD5 when being asked\n to clone SHA1.\n - XWing implementation updated to draft-connolly-cfrg-xwing-kem/07/\n - Further support has been added for generation and use of PGP V6 keys\n - Additional validation has been added for armored headers in Cleartext\n Signed Messages.\n - The PQC signature algorithm proposal Mayo has been added to the\n low-level API and the BCPQC provider.\n - The PQC signature algorithm proposal Snova has been added to the\n low-level API and the BCPQC provider.\n - Support for ChaCha20-Poly1305 has been added to the CMS/SMIME APIs.\n - The Falcon implementation has been updated to the latest draft.\n - Support has been added for generating keys which encode as seed-only\n and expanded-key-only for ML-KEM and ML-DSA private keys.\n - Private key encoding of ML-DSA and ML-KEM private keys now follows\n the latest IETF draft.\n - The Ascon family of algorithms has been updated to the initial draft\n of SP 800-232. Some additional optimisation work has been done.\n - Support for ML-DSA\u0027s external-mu calculation and signing has been\n added to the BC provider.\n - CMS now supports ML-DSA for SignedData generation.\n - Introduce high-level OpenPGP API for message creation/consumption\n and certificate evaluation.\n - Added JDK21 KEM API implementation for HQC algorithm.\n - BCJSSE: Strip trailing dot from hostname for SNI, endpointID checks.\n - BCJSSE: Draft support for ML-KEM updated (draft-connolly-tls-mlkem-key-agreement-05).\n - BCJSSE: Draft support for hybrid ECDHE-MLKEM (draft-ietf-tls-ecdhe-mlkem-00).\n - BCJSSE: Optionally prefer TLS 1.3 server\u0027s supported_groups order\n (BCSSLParameters.useNamedGroupsOrder).\n\n- Version 1.80:\n - A splitting issue for ML-KEM led to an incorrect size for kemct\n in KEMRecipientInfos. This has been fixed.\n - The PKCS12 KeyStore has been adjusted to prevent accidental doubling\n of the Oracle trusted certificate attribute (results in an IOException\n when used with the JVM PKCS12 implementation).\n - The SignerInfoGenerator copy constructor was ignoring the certHolder field.\n - The getAlgorithm() method return value for a CompositePrivateKey was\n not consistent with the corresponding getAlgorithm() return value for\n the CompositePrivateKey. This has been fixed.\n - The international property files were missing from the bcjmail distribution.\n - Issues with ElephantEngine failing on processing large/multi-block messages\n have been addressed.\n - GCFB mode now fully resets on a reset.\n - The lightweight algorithm contestants: Elephant, ISAP, PhotonBeetle,\n Xoodyak now support the use of the AEADParameters class and provide\n accurate update/doFinal output lengths.\n - An unnecessary downcast in CertPathValidatorUtilities was resulting\n in the ignoring of URLs for FTP based CRLs.\n - A regression in the OpenPGP API could cause NoSuchAlgorithmException\n to be thrown when attempting to use SHA-256 in some contexts.\n - EtsiTs1029411TypesAuthorization was missing an extension field.\n - Interoperability issues with single depth LMS keys have been addressed.\n - CompositeSignatures now updated to draft-ietf-lamps-pq-composite-sigs-03.\n - ML-KEM, ML-DSA, SLH-DSA, and Composite private keys now use raw encodings\n as per the latest drafts from IETF 121: draft-ietf-lamps-kyber-certificates-06,\n draft-ietf-lamps-dilithium-certificates-05, and draft-ietf-lamps-x509-slhdsa.\n - Initial support has been added for RFC 9579 PBMAC1 in the PKCS API.\n - Support has been added for EC-JPAKE to the lightweight API.\n - Support has been added for the direct construction of S/MIME AuthEnvelopedData\n objects, via the SMIMEAuthEnvelopedData class.\n - An override \u0027org.bouncycastle.asn1.allow_wrong_oid_enc\u0027 property has been\n added to disable new OID encoding checks (use with caution).\n - Support has been added for the PBEParemeterSpec.getParameterSpec()\n method where supported by the JVM.\n - ML-DSA/SLH-DSA now return null for Signature.getParameters() if no context\n is provided. This allows the algorithms to be used with the existing Java key tool.\n - HQC has been updated to reflect the reference implementation released on 2024-10-30.\n - Support has been added to the low-level APIs for the OASIS Shamir Secret\n Splitting algorithms.\n - BCJSSE: System property \u0027org.bouncycastle.jsse.fips.allowGCMCiphersIn12\u0027\n no longer used. FIPS TLS 1.2 GCM suites can now be enabled according to\n JcaTlsCrypto#getFipsGCMNonceGeneratorFactory (see JavaDoc for details) if\n done in alignment with FIPS requirements.\n - Support has been added for OpenPGP V6 PKESK and message encryption.\n - PGPSecretKey.copyWithNewPassword() now includes AEAD support.\n - The ASCON family of algorithms have been updated in accordance with the\n published FIPS SP 800-232 draft.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1639,SUSE-SLE-Module-Development-Tools-15-SP7-2026-1639,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1639,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1639,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1639,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1639",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1639-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1639-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261639-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1639-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025753.html"
},
{
"category": "self",
"summary": "SUSE Bug 1262225",
"url": "https://bugzilla.suse.com/1262225"
},
{
"category": "self",
"summary": "SUSE Bug 1262226",
"url": "https://bugzilla.suse.com/1262226"
},
{
"category": "self",
"summary": "SUSE Bug 1262227",
"url": "https://bugzilla.suse.com/1262227"
},
{
"category": "self",
"summary": "SUSE Bug 1262228",
"url": "https://bugzilla.suse.com/1262228"
},
{
"category": "self",
"summary": "SUSE Bug 1262232",
"url": "https://bugzilla.suse.com/1262232"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14813 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14813/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-0636 page",
"url": "https://www.suse.com/security/cve/CVE-2026-0636/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-3505 page",
"url": "https://www.suse.com/security/cve/CVE-2026-3505/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5588 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5588/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5598/"
}
],
"title": "Security update for bouncycastle",
"tracking": {
"current_release_date": "2026-04-28T11:10:37Z",
"generator": {
"date": "2026-04-28T11:10:37Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1639-1",
"initial_release_date": "2026-04-28T11:10:37Z",
"revision_history": [
{
"date": "2026-04-28T11:10:37Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "bouncycastle-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-javadoc-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-javadoc-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-javadoc-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-jmail-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-jmail-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-jmail-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-mail-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-mail-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-mail-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-pg-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-pkix-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-tls-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-tls-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-tls-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-util-1.84-150200.3.35.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-development-tools:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14813"
}
],
"notes": [
{
"category": "general",
"text": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher.\n\nGOSTCTR implementation unable to process more than 255 blocks correctly.\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14813",
"url": "https://www.suse.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "SUSE Bug 1262225 for CVE-2025-14813",
"url": "https://bugzilla.suse.com/1262225"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "important"
}
],
"title": "CVE-2025-14813"
},
{
"cve": "CVE-2026-0636",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-0636"
}
],
"notes": [
{
"category": "general",
"text": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-0636",
"url": "https://www.suse.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "SUSE Bug 1262226 for CVE-2026-0636",
"url": "https://bugzilla.suse.com/1262226"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "moderate"
}
],
"title": "CVE-2026-0636"
},
{
"cve": "CVE-2026-3505",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-3505"
}
],
"notes": [
{
"category": "general",
"text": "Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-3505",
"url": "https://www.suse.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "SUSE Bug 1262232 for CVE-2026-3505",
"url": "https://bugzilla.suse.com/1262232"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "important"
}
],
"title": "CVE-2026-3505"
},
{
"cve": "CVE-2026-5588",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5588"
}
],
"notes": [
{
"category": "general",
"text": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java.\n\nThis issue affects BC-JAVA: from 1.67 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5588",
"url": "https://www.suse.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "SUSE Bug 1262228 for CVE-2026-5588",
"url": "https://bugzilla.suse.com/1262228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "moderate"
}
],
"title": "CVE-2026-5588"
},
{
"cve": "CVE-2026-5598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5598"
}
],
"notes": [
{
"category": "general",
"text": "Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java.\n\nThis issue affects BC-JAVA: from 1.71 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5598",
"url": "https://www.suse.com/security/cve/CVE-2026-5598"
},
{
"category": "external",
"summary": "SUSE Bug 1262227 for CVE-2026-5598",
"url": "https://bugzilla.suse.com/1262227"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "important"
}
],
"title": "CVE-2026-5598"
}
]
}
SUSE-SU-2026:21404-1
Vulnerability from csaf_suse - Published: 2026-04-24 15:54 - Updated: 2026-04-24 15:54Summary
Security update for bouncycastle
Severity
Important
Notes
Title of the patch: Security update for bouncycastle
Description of the patch: This update for bouncycastle fixes the following issues:
- Update to version 1.84:
- CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).
- CVE-2026-0636: LDAP Injection Vulnerability in LDAPStoreHelper.java (bsc#1262226).
- CVE-2026-3505: Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).
- CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).
- CVE-2026-5598: Non-constant time comparisons risk private key leakage in FrodoKEM (bsc#1262227).
Patchnames: SUSE-SLES-16.0-643
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.6 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
8.6 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
24 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for bouncycastle",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for bouncycastle fixes the following issues:\n\n- Update to version 1.84:\n- CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).\n- CVE-2026-0636: LDAP Injection Vulnerability in LDAPStoreHelper.java (bsc#1262226).\n- CVE-2026-3505: Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).\n- CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).\n- CVE-2026-5598: Non-constant time comparisons risk private key leakage in FrodoKEM (bsc#1262227).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-643",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21404-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:21404-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621404-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:21404-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/046131.html"
},
{
"category": "self",
"summary": "SUSE Bug 1262225",
"url": "https://bugzilla.suse.com/1262225"
},
{
"category": "self",
"summary": "SUSE Bug 1262226",
"url": "https://bugzilla.suse.com/1262226"
},
{
"category": "self",
"summary": "SUSE Bug 1262227",
"url": "https://bugzilla.suse.com/1262227"
},
{
"category": "self",
"summary": "SUSE Bug 1262228",
"url": "https://bugzilla.suse.com/1262228"
},
{
"category": "self",
"summary": "SUSE Bug 1262232",
"url": "https://bugzilla.suse.com/1262232"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14813 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14813/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-0636 page",
"url": "https://www.suse.com/security/cve/CVE-2026-0636/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-3505 page",
"url": "https://www.suse.com/security/cve/CVE-2026-3505/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5588 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5588/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5598/"
}
],
"title": "Security update for bouncycastle",
"tracking": {
"current_release_date": "2026-04-24T15:54:52Z",
"generator": {
"date": "2026-04-24T15:54:52Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:21404-1",
"initial_release_date": "2026-04-24T15:54:52Z",
"revision_history": [
{
"date": "2026-04-24T15:54:52Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "bouncycastle-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-javadoc-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-javadoc-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-javadoc-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-jmail-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-jmail-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-jmail-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-mail-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-mail-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-mail-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-pg-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-pg-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-pg-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-pkix-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-pkix-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-pkix-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-tls-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-tls-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-tls-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-util-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-util-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-util-1.84-160000.1.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16.0"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-javadoc-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-javadoc-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-jmail-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-jmail-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-mail-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-mail-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-tls-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-tls-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-javadoc-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-javadoc-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-jmail-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-jmail-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-mail-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-mail-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-tls-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-tls-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14813"
}
],
"notes": [
{
"category": "general",
"text": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher.\n\nGOSTCTR implementation unable to process more than 255 blocks correctly.\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14813",
"url": "https://www.suse.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "SUSE Bug 1262225 for CVE-2025-14813",
"url": "https://bugzilla.suse.com/1262225"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "important"
}
],
"title": "CVE-2025-14813"
},
{
"cve": "CVE-2026-0636",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-0636"
}
],
"notes": [
{
"category": "general",
"text": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-0636",
"url": "https://www.suse.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "SUSE Bug 1262226 for CVE-2026-0636",
"url": "https://bugzilla.suse.com/1262226"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "moderate"
}
],
"title": "CVE-2026-0636"
},
{
"cve": "CVE-2026-3505",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-3505"
}
],
"notes": [
{
"category": "general",
"text": "Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-3505",
"url": "https://www.suse.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "SUSE Bug 1262232 for CVE-2026-3505",
"url": "https://bugzilla.suse.com/1262232"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "important"
}
],
"title": "CVE-2026-3505"
},
{
"cve": "CVE-2026-5588",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5588"
}
],
"notes": [
{
"category": "general",
"text": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java.\n\nThis issue affects BC-JAVA: from 1.67 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5588",
"url": "https://www.suse.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "SUSE Bug 1262228 for CVE-2026-5588",
"url": "https://bugzilla.suse.com/1262228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "moderate"
}
],
"title": "CVE-2026-5588"
},
{
"cve": "CVE-2026-5598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5598"
}
],
"notes": [
{
"category": "general",
"text": "Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java.\n\nThis issue affects BC-JAVA: from 1.71 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5598",
"url": "https://www.suse.com/security/cve/CVE-2026-5598"
},
{
"category": "external",
"summary": "SUSE Bug 1262227 for CVE-2026-5598",
"url": "https://bugzilla.suse.com/1262227"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "important"
}
],
"title": "CVE-2026-5598"
}
]
}
ubuntu-cve-2026-0636
Vulnerability from osv_ubuntu
Published
2026-04-15 10:16
Modified
2026-06-30 16:18
Summary
Details
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Severity
5.5 (Medium)
6.5 (Medium)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libbcmail-java",
"binary_version": "1.51-4ubuntu1+esm1"
},
{
"binary_name": "libbcpg-java",
"binary_version": "1.51-4ubuntu1+esm1"
},
{
"binary_name": "libbcpkix-java",
"binary_version": "1.51-4ubuntu1+esm1"
},
{
"binary_name": "libbcprov-java",
"binary_version": "1.51-4ubuntu1+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "bouncycastle",
"purl": "pkg:deb/ubuntu/bouncycastle@1.51-4ubuntu1+esm1?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.49+dfsg-3ubuntu1",
"1.51-4ubuntu1",
"1.51-4ubuntu1+esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libbcmail-java",
"binary_version": "1.59-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcpg-java",
"binary_version": "1.59-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcpkix-java",
"binary_version": "1.59-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcprov-java",
"binary_version": "1.59-1ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "bouncycastle",
"purl": "pkg:deb/ubuntu/bouncycastle@1.59-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.57-1",
"1.58-1",
"1.59-1",
"1.59-1ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libbcmail-java",
"binary_version": "1.61-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcpg-java",
"binary_version": "1.61-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcpkix-java",
"binary_version": "1.61-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcprov-java",
"binary_version": "1.61-1ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "bouncycastle",
"purl": "pkg:deb/ubuntu/bouncycastle@1.61-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.61-1",
"1.61-1ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libbcmail-java",
"binary_version": "1.68-5ubuntu0.1~esm1"
},
{
"binary_name": "libbcpg-java",
"binary_version": "1.68-5ubuntu0.1~esm1"
},
{
"binary_name": "libbcpkix-java",
"binary_version": "1.68-5ubuntu0.1~esm1"
},
{
"binary_name": "libbcprov-java",
"binary_version": "1.68-5ubuntu0.1~esm1"
},
{
"binary_name": "libbctls-java",
"binary_version": "1.68-5ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:22.04:LTS",
"name": "bouncycastle",
"purl": "pkg:deb/ubuntu/bouncycastle@1.68-5ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.68-2",
"1.68-4",
"1.68-5",
"1.68-5ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libbcjmail-java",
"binary_version": "1.77-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcmail-java",
"binary_version": "1.77-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcpg-java",
"binary_version": "1.77-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcpkix-java",
"binary_version": "1.77-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcprov-java",
"binary_version": "1.77-1ubuntu0.1~esm1"
},
{
"binary_name": "libbctls-java",
"binary_version": "1.77-1ubuntu0.1~esm1"
},
{
"binary_name": "libbcutil-java",
"binary_version": "1.77-1ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:24.04:LTS",
"name": "bouncycastle",
"purl": "pkg:deb/ubuntu/bouncycastle@1.77-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.72-2",
"1.77-1",
"1.77-1ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libbcjmail-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcmail-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcpg-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcpkix-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcprov-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbctls-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcutil-java",
"binary_version": "1.80-3"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "bouncycastle",
"purl": "pkg:deb/ubuntu/bouncycastle@1.80-3?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.77-1",
"1.80-3"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libbcjmail-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcmail-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcpg-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcpkix-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcprov-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbctls-java",
"binary_version": "1.80-3"
},
{
"binary_name": "libbcutil-java",
"binary_version": "1.80-3"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "bouncycastle",
"purl": "pkg:deb/ubuntu/bouncycastle@1.80-3?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.80-3"
]
}
],
"aliases": [],
"details": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.",
"id": "UBUNTU-CVE-2026-0636",
"modified": "2026-06-30T16:18:31Z",
"published": "2026-04-15T10:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-0636"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"type": "REPORT",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"type": "REPORT",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-0636"
]
}
WID-SEC-W-2026-1129
Vulnerability from csaf_certbund - Published: 2026-04-15 22:00 - Updated: 2026-08-04 22:00Summary
Bouncy Castle BC-JAVA: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Bouncy Castle ist eine Kryptographie-API für Java.
Angriff: Ein Angreifer kann mehrere Schwachstellen in Bouncy Castle BC-JAVA ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
Betroffene Betriebssysteme: - Linux
- MacOS X
- Sonstiges
- UNIX
- Windows
Affected products
Known affected
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source DBeaver <26.0.4
Open Source / DBeaver
|
<26.0.4 | ||
|
Red Hat Enterprise Linux
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Enterprise Linux Apache Camel for Spring Boot
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot
|
Apache Camel for Spring Boot | |
|
IBM Business Automation Workflow
IBM
|
cpe:/a:ibm:business_automation_workflow:-
|
— | |
|
Open Source Bouncy Castle <1.84
Open Source / Bouncy Castle
|
<1.84 | ||
|
Open Source Keycloak <26.6.2
Open Source / Keycloak
|
<26.6.2 | ||
|
IBM InfoSphere Information Server
IBM
|
cpe:/a:ibm:infosphere_information_server:-
|
— | |
|
IBM SPSS Modeler
IBM / SPSS
|
cpe:/a:ibm:spss:modeler
|
Modeler | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
IBM App Connect Enterprise
IBM
|
cpe:/a:ibm:app_connect_enterprise:-
|
— | |
|
Red Hat OpenShift Dev Spaces <3.28.0
Red Hat / OpenShift
|
Dev Spaces <3.28.0 | ||
|
IBM QRadar SIEM
IBM
|
cpe:/a:ibm:qradar_siem:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
IBM Tivoli Network Manager IP Edition 4.2.0
IBM / Tivoli Network Manager
|
cpe:/a:ibm:tivoli_network_manager:ip_edition_4.2.0
|
IP Edition 4.2.0 | |
|
IBM MQ
IBM
|
cpe:/a:ibm:mq:-
|
— | |
|
IBM DB2
IBM
|
cpe:/a:ibm:db2:-
|
— |
Affected products
Known affected
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source DBeaver <26.0.4
Open Source / DBeaver
|
<26.0.4 | ||
|
Red Hat Enterprise Linux
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Enterprise Linux Apache Camel for Spring Boot
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot
|
Apache Camel for Spring Boot | |
|
IBM Business Automation Workflow
IBM
|
cpe:/a:ibm:business_automation_workflow:-
|
— | |
|
Open Source Bouncy Castle <1.84
Open Source / Bouncy Castle
|
<1.84 | ||
|
Open Source Keycloak <26.6.2
Open Source / Keycloak
|
<26.6.2 | ||
|
IBM InfoSphere Information Server
IBM
|
cpe:/a:ibm:infosphere_information_server:-
|
— | |
|
IBM SPSS Modeler
IBM / SPSS
|
cpe:/a:ibm:spss:modeler
|
Modeler | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
IBM App Connect Enterprise
IBM
|
cpe:/a:ibm:app_connect_enterprise:-
|
— | |
|
Red Hat OpenShift Dev Spaces <3.28.0
Red Hat / OpenShift
|
Dev Spaces <3.28.0 | ||
|
IBM QRadar SIEM
IBM
|
cpe:/a:ibm:qradar_siem:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
IBM Tivoli Network Manager IP Edition 4.2.0
IBM / Tivoli Network Manager
|
cpe:/a:ibm:tivoli_network_manager:ip_edition_4.2.0
|
IP Edition 4.2.0 | |
|
IBM MQ
IBM
|
cpe:/a:ibm:mq:-
|
— | |
|
IBM DB2
IBM
|
cpe:/a:ibm:db2:-
|
— |
Affected products
Known affected
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source DBeaver <26.0.4
Open Source / DBeaver
|
<26.0.4 | ||
|
Red Hat Enterprise Linux
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Enterprise Linux Apache Camel for Spring Boot
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot
|
Apache Camel for Spring Boot | |
|
IBM Business Automation Workflow
IBM
|
cpe:/a:ibm:business_automation_workflow:-
|
— | |
|
Open Source Bouncy Castle <1.84
Open Source / Bouncy Castle
|
<1.84 | ||
|
Open Source Keycloak <26.6.2
Open Source / Keycloak
|
<26.6.2 | ||
|
IBM InfoSphere Information Server
IBM
|
cpe:/a:ibm:infosphere_information_server:-
|
— | |
|
IBM SPSS Modeler
IBM / SPSS
|
cpe:/a:ibm:spss:modeler
|
Modeler | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
IBM App Connect Enterprise
IBM
|
cpe:/a:ibm:app_connect_enterprise:-
|
— | |
|
Red Hat OpenShift Dev Spaces <3.28.0
Red Hat / OpenShift
|
Dev Spaces <3.28.0 | ||
|
IBM QRadar SIEM
IBM
|
cpe:/a:ibm:qradar_siem:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
IBM Tivoli Network Manager IP Edition 4.2.0
IBM / Tivoli Network Manager
|
cpe:/a:ibm:tivoli_network_manager:ip_edition_4.2.0
|
IP Edition 4.2.0 | |
|
IBM MQ
IBM
|
cpe:/a:ibm:mq:-
|
— | |
|
IBM DB2
IBM
|
cpe:/a:ibm:db2:-
|
— |
Affected products
Known affected
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source DBeaver <26.0.4
Open Source / DBeaver
|
<26.0.4 | ||
|
Red Hat Enterprise Linux
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Enterprise Linux Apache Camel for Spring Boot
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot
|
Apache Camel for Spring Boot | |
|
IBM Business Automation Workflow
IBM
|
cpe:/a:ibm:business_automation_workflow:-
|
— | |
|
Open Source Bouncy Castle <1.84
Open Source / Bouncy Castle
|
<1.84 | ||
|
Open Source Keycloak <26.6.2
Open Source / Keycloak
|
<26.6.2 | ||
|
IBM InfoSphere Information Server
IBM
|
cpe:/a:ibm:infosphere_information_server:-
|
— | |
|
IBM SPSS Modeler
IBM / SPSS
|
cpe:/a:ibm:spss:modeler
|
Modeler | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
IBM App Connect Enterprise
IBM
|
cpe:/a:ibm:app_connect_enterprise:-
|
— | |
|
Red Hat OpenShift Dev Spaces <3.28.0
Red Hat / OpenShift
|
Dev Spaces <3.28.0 | ||
|
IBM QRadar SIEM
IBM
|
cpe:/a:ibm:qradar_siem:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
IBM Tivoli Network Manager IP Edition 4.2.0
IBM / Tivoli Network Manager
|
cpe:/a:ibm:tivoli_network_manager:ip_edition_4.2.0
|
IP Edition 4.2.0 | |
|
IBM MQ
IBM
|
cpe:/a:ibm:mq:-
|
— | |
|
IBM DB2
IBM
|
cpe:/a:ibm:db2:-
|
— |
References
31 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Bouncy Castle ist eine Kryptographie-API f\u00fcr Java.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Bouncy Castle BC-JAVA ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-1129 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1129.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-1129 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1129"
},
{
"category": "external",
"summary": "BouncyCastle Wiki CVE-2025-14813 vom 2026-04-15",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
},
{
"category": "external",
"summary": "BouncyCastle Wiki CVE-2026-0636 vom 2026-04-15",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
},
{
"category": "external",
"summary": "BouncyCastle Wiki CVE-2026-3505 vom 2026-04-15",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
},
{
"category": "external",
"summary": "BouncyCastle Wiki CVE-2026-5588 vom 2026-04-15",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-04-15",
"url": "https://github.com/bcgit/bc-java/releases/tag/r1rv84"
},
{
"category": "external",
"summary": "openSUSE Security Update OPENSUSE-SU-2026:10571-1 vom 2026-04-19",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HGBBPEJ3FFTXLISJLILUZ4P6VWU4FBFE/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:1639-1 vom 2026-04-28",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025753.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:21404-1 vom 2026-04-30",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025782.html"
},
{
"category": "external",
"summary": "DBeaver Release 26.0.4 vom 2026-05-03",
"url": "https://github.com/dbeaver/dbeaver/releases/tag/26.0.4"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:11720 vom 2026-05-05",
"url": "https://access.redhat.com/errata/RHSA-2026:11720"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:11721 vom 2026-05-05",
"url": "https://access.redhat.com/errata/RHSA-2026:11721"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:13631 vom 2026-05-05",
"url": "https://access.redhat.com/errata/RHSA-2026:13631"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:14276 vom 2026-05-06",
"url": "https://access.redhat.com/errata/RHSA-2026:14276"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:14272 vom 2026-05-06",
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:17668 vom 2026-05-14",
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7273145 vom 2026-05-15",
"url": "https://www.ibm.com/support/pages/node/7273145"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:18059 vom 2026-05-18",
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:18054 vom 2026-05-18",
"url": "https://access.redhat.com/errata/RHSA-2026:18054"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:18055 vom 2026-05-18",
"url": "https://access.redhat.com/errata/RHSA-2026:18055"
},
{
"category": "external",
"summary": "Keycloak 26.6.2 release vom 2026-05-19",
"url": "https://www.keycloak.org/2026/05/keycloak-2662-released"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:21772 vom 2026-05-29",
"url": "https://access.redhat.com/errata/RHSA-2026:21772"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:24977 vom 2026-06-10",
"url": "https://access.redhat.com/errata/RHSA-2026:24977"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7275937 vom 2026-06-11",
"url": "https://www.ibm.com/support/pages/node/7275937"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7277422 vom 2026-06-23",
"url": "https://www.ibm.com/support/pages/node/7277422"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7275291 vom 2026-06-24",
"url": "https://www.ibm.com/support/pages/node/7275291"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7278326 vom 2026-06-29",
"url": "https://www.ibm.com/support/pages/node/7278326"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7279712 vom 2026-07-10",
"url": "https://www.ibm.com/support/pages/node/7279712"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7280950 vom 2026-07-23",
"url": "https://www.ibm.com/support/pages/node/7280950"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7282596 vom 2026-08-05",
"url": "https://www.ibm.com/support/pages/node/7282596"
}
],
"source_lang": "en-US",
"title": "Bouncy Castle BC-JAVA: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-08-04T22:00:00.000+00:00",
"generator": {
"date": "2026-08-05T09:01:41.878+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-1129",
"initial_release_date": "2026-04-15T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-04-15T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-04-19T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von openSUSE aufgenommen"
},
{
"date": "2026-04-28T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-05-03T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-05-04T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-06T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-14T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-17T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2026-05-18T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-19T22:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates aufgenommen"
},
{
"date": "2026-05-28T22:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-09T22:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-10T22:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2026-06-23T22:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2026-06-24T22:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2026-06-28T22:00:00.000+00:00",
"number": "16",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2026-07-09T22:00:00.000+00:00",
"number": "17",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2026-07-23T22:00:00.000+00:00",
"number": "18",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2026-08-04T22:00:00.000+00:00",
"number": "19",
"summary": "Neue Updates von IBM aufgenommen"
}
],
"status": "final",
"version": "19"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "IBM App Connect Enterprise",
"product": {
"name": "IBM App Connect Enterprise",
"product_id": "T051349",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:app_connect_enterprise:-"
}
}
},
{
"category": "product_name",
"name": "IBM Business Automation Workflow",
"product": {
"name": "IBM Business Automation Workflow",
"product_id": "T053688",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:business_automation_workflow:-"
}
}
},
{
"category": "product_name",
"name": "IBM DB2",
"product": {
"name": "IBM DB2",
"product_id": "T048379",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:db2:-"
}
}
},
{
"category": "product_name",
"name": "IBM InfoSphere Information Server",
"product": {
"name": "IBM InfoSphere Information Server",
"product_id": "T019995",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:infosphere_information_server:-"
}
}
},
{
"category": "product_name",
"name": "IBM MQ",
"product": {
"name": "IBM MQ",
"product_id": "T021398",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:mq:-"
}
}
},
{
"category": "product_name",
"name": "IBM QRadar SIEM",
"product": {
"name": "IBM QRadar SIEM",
"product_id": "T021415",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:qradar_siem:-"
}
}
},
{
"branches": [
{
"category": "product_version",
"name": "Modeler",
"product": {
"name": "IBM SPSS Modeler",
"product_id": "T018587",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:spss:modeler"
}
}
}
],
"category": "product_name",
"name": "SPSS"
},
{
"branches": [
{
"category": "product_version",
"name": "IP Edition 4.2.0",
"product": {
"name": "IBM Tivoli Network Manager IP Edition 4.2.0",
"product_id": "T048330",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition_4.2.0"
}
}
}
],
"category": "product_name",
"name": "Tivoli Network Manager"
}
],
"category": "vendor",
"name": "IBM"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c1.84",
"product": {
"name": "Open Source Bouncy Castle \u003c1.84",
"product_id": "T052875"
}
},
{
"category": "product_version",
"name": "1.84",
"product": {
"name": "Open Source Bouncy Castle 1.84",
"product_id": "T052875-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.84"
}
}
}
],
"category": "product_name",
"name": "Bouncy Castle"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c26.0.4",
"product": {
"name": "Open Source DBeaver \u003c26.0.4",
"product_id": "T053463"
}
},
{
"category": "product_version",
"name": "26.0.4",
"product": {
"name": "Open Source DBeaver 26.0.4",
"product_id": "T053463-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:dbeaver:dbeaver:26.0.4"
}
}
}
],
"category": "product_name",
"name": "DBeaver"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c26.6.2",
"product": {
"name": "Open Source Keycloak \u003c26.6.2",
"product_id": "T054335"
}
},
{
"category": "product_version",
"name": "26.6.2",
"product": {
"name": "Open Source Keycloak 26.6.2",
"product_id": "T054335-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:keycloak:keycloak:26.6.2"
}
}
}
],
"category": "product_name",
"name": "Keycloak"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
},
{
"category": "product_version",
"name": "Apache Camel for Spring Boot",
"product": {
"name": "Red Hat Enterprise Linux Apache Camel for Spring Boot",
"product_id": "T040879",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot"
}
}
}
],
"category": "product_name",
"name": "Enterprise Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "Dev Spaces \u003c3.28.0",
"product": {
"name": "Red Hat OpenShift Dev Spaces \u003c3.28.0",
"product_id": "T054838"
}
},
{
"category": "product_version",
"name": "Dev Spaces 3.28.0",
"product": {
"name": "Red Hat OpenShift Dev Spaces 3.28.0",
"product_id": "T054838-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:dev_spaces__3.28.0"
}
}
}
],
"category": "product_name",
"name": "OpenShift"
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
},
{
"category": "product_name",
"name": "SUSE openSUSE",
"product": {
"name": "SUSE openSUSE",
"product_id": "T027843",
"product_identification_helper": {
"cpe": "cpe:/o:suse:opensuse:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"product_status": {
"known_affected": [
"T053463",
"67646",
"T040879",
"T053688",
"T052875",
"T054335",
"T019995",
"T018587",
"T002207",
"T051349",
"T054838",
"T021415",
"T027843",
"T048330",
"T021398",
"T048379"
]
},
"release_date": "2026-04-15T22:00:00.000+00:00",
"title": "CVE-2025-14813"
},
{
"cve": "CVE-2026-0636",
"product_status": {
"known_affected": [
"T053463",
"67646",
"T040879",
"T053688",
"T052875",
"T054335",
"T019995",
"T018587",
"T002207",
"T051349",
"T054838",
"T021415",
"T027843",
"T048330",
"T021398",
"T048379"
]
},
"release_date": "2026-04-15T22:00:00.000+00:00",
"title": "CVE-2026-0636"
},
{
"cve": "CVE-2026-3505",
"product_status": {
"known_affected": [
"T053463",
"67646",
"T040879",
"T053688",
"T052875",
"T054335",
"T019995",
"T018587",
"T002207",
"T051349",
"T054838",
"T021415",
"T027843",
"T048330",
"T021398",
"T048379"
]
},
"release_date": "2026-04-15T22:00:00.000+00:00",
"title": "CVE-2026-3505"
},
{
"cve": "CVE-2026-5588",
"product_status": {
"known_affected": [
"T053463",
"67646",
"T040879",
"T053688",
"T052875",
"T054335",
"T019995",
"T018587",
"T002207",
"T051349",
"T054838",
"T021415",
"T027843",
"T048330",
"T021398",
"T048379"
]
},
"release_date": "2026-04-15T22:00:00.000+00:00",
"title": "CVE-2026-5588"
}
]
}
WID-SEC-W-2026-1687
Vulnerability from csaf_certbund - Published: 2026-05-26 22:00 - Updated: 2026-05-26 22:00Summary
IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Das IBM License Metric Tool dient der Lizenzverwaltung für IBM Produkte.
Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Betroffene Betriebssysteme: - Linux
- Sonstiges
- UNIX
- Windows
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
IBM License Metric Tool 9.2
IBM / License Metric Tool
|
cpe:/a:ibm:license_metric_tool:9.2
|
9.2 |
References
3 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Das IBM License Metric Tool dient der Lizenzverwaltung f\u00fcr IBM Produkte.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um einen nicht n\u00e4her spezifizierten Angriff durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-1687 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1687.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-1687 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1687"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7273983 vom 2026-05-26",
"url": "https://www.ibm.com/support/pages/node/7273983"
}
],
"source_lang": "en-US",
"title": "IBM License Metric Tool: Mehrere Schwachstellen erm\u00f6glichen nicht spezifizierten Angriff",
"tracking": {
"current_release_date": "2026-05-26T22:00:00.000+00:00",
"generator": {
"date": "2026-05-27T11:20:42.217+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-1687",
"initial_release_date": "2026-05-26T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-05-26T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "9.2",
"product": {
"name": "IBM License Metric Tool 9.2",
"product_id": "T031605",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:license_metric_tool:9.2"
}
}
}
],
"category": "product_name",
"name": "License Metric Tool"
}
],
"category": "vendor",
"name": "IBM"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-26141",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2024-26141"
},
{
"cve": "CVE-2024-29371",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2024-29371"
},
{
"cve": "CVE-2024-34459",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2024-34459"
},
{
"cve": "CVE-2025-14917",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2025-14917"
},
{
"cve": "CVE-2025-14923",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2025-14923"
},
{
"cve": "CVE-2025-62718",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2025-62718"
},
{
"cve": "CVE-2025-6490",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2025-6490"
},
{
"cve": "CVE-2026-0636",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-0636"
},
{
"cve": "CVE-2026-1561",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-1561"
},
{
"cve": "CVE-2026-22007",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-22007"
},
{
"cve": "CVE-2026-22008",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-22008"
},
{
"cve": "CVE-2026-22013",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-22013"
},
{
"cve": "CVE-2026-22016",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-22016"
},
{
"cve": "CVE-2026-22018",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-22018"
},
{
"cve": "CVE-2026-22021",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-22021"
},
{
"cve": "CVE-2026-23865",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-23865"
},
{
"cve": "CVE-2026-23907",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-23907"
},
{
"cve": "CVE-2026-26961",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-26961"
},
{
"cve": "CVE-2026-33168",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-33168"
},
{
"cve": "CVE-2026-33169",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-33169"
},
{
"cve": "CVE-2026-33170",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-33170"
},
{
"cve": "CVE-2026-33173",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-33173"
},
{
"cve": "CVE-2026-33174",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-33174"
},
{
"cve": "CVE-2026-33176",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-33176"
},
{
"cve": "CVE-2026-33195",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-33195"
},
{
"cve": "CVE-2026-33202",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-33202"
},
{
"cve": "CVE-2026-33929",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-33929"
},
{
"cve": "CVE-2026-34230",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34230"
},
{
"cve": "CVE-2026-34268",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34268"
},
{
"cve": "CVE-2026-34282",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34282"
},
{
"cve": "CVE-2026-34763",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34763"
},
{
"cve": "CVE-2026-34785",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34785"
},
{
"cve": "CVE-2026-34786",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34786"
},
{
"cve": "CVE-2026-34826",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34826"
},
{
"cve": "CVE-2026-34829",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34829"
},
{
"cve": "CVE-2026-34830",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34830"
},
{
"cve": "CVE-2026-34831",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-34831"
},
{
"cve": "CVE-2026-35611",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-35611"
},
{
"cve": "CVE-2026-42033",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42033"
},
{
"cve": "CVE-2026-42034",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42034"
},
{
"cve": "CVE-2026-42035",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42035"
},
{
"cve": "CVE-2026-42036",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42036"
},
{
"cve": "CVE-2026-42037",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42037"
},
{
"cve": "CVE-2026-42038",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42038"
},
{
"cve": "CVE-2026-42039",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42039"
},
{
"cve": "CVE-2026-42040",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42040"
},
{
"cve": "CVE-2026-42041",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42041"
},
{
"cve": "CVE-2026-42042",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42042"
},
{
"cve": "CVE-2026-42043",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42043"
},
{
"cve": "CVE-2026-42044",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42044"
},
{
"cve": "CVE-2026-42264",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-42264"
},
{
"cve": "CVE-2026-5588",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-5588"
},
{
"cve": "CVE-2026-6918",
"product_status": {
"known_affected": [
"T031605"
]
},
"release_date": "2026-05-26T22:00:00.000+00:00",
"title": "CVE-2026-6918"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…