Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-2332 (GCVE-0-2026-2332)
Vulnerability from cvelistv5 – Published: 2026-04-14 10:59 – Updated: 2026-09-10 12:05
VLAI
EPSS
VEX
Title
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Summary
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:
* https://w4ke.info/2025/06/18/funky-chunks.html
* https://w4ke.info/2025/10/29/funky-chunks-2.html
Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.
POST / HTTP/1.1
Host: localhost
Transfer-Encoding: chunked
1;ext="val
X
0
GET /smuggled HTTP/1.1
...
Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-14 00:00 UTC
CWE
Assigner
References
27 references
Impacted products
43 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty |
Affected:
12.1.0 , ≤ 12.1.6
(semver)
Affected: 12.0.0 , ≤ 12.0.32 (semver) Affected: 11.0.0 , ≤ 11.0.28 (semver) Affected: 10.0.0 , ≤ 10.0.27 (semver) Affected: 9.4.0 , ≤ 9.4.59 (semver) |
guessed | |
| Red Hat | HawtIO HawtIO 4.4.0 |
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
||
| Red Hat | Red Hat AMQ Broker 7.13.5 |
cpe:/a:redhat:amq_broker:7.13
|
||
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 |
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
||
| Red Hat | Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 |
cpe:/a:redhat:apache_camel_quarkus:3.33
|
||
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:8.2.0-19.el9_8.2 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9::crb |
||
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 |
Unaffected:
0:8.14.1-1.el8sat , < *
(rpm)
cpe:/a:redhat:satellite:6.16::el8 cpe:/a:redhat:satellite_capsule:6.16::el8 |
||
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 |
Unaffected:
0:8.14.1-1.el9sat , < *
(rpm)
cpe:/a:redhat:satellite:6.16::el9 cpe:/a:redhat:satellite_capsule:6.16::el9 |
||
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 |
Unaffected:
0:8.14.1-1.el9sat , < *
(rpm)
cpe:/a:redhat:satellite:6.17::el9 cpe:/a:redhat:satellite_capsule:6.17::el9 |
||
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 |
Unaffected:
0:8.14.1-1.el9sat , < *
(rpm)
cpe:/a:redhat:satellite:6.18::el9 cpe:/a:redhat:satellite_capsule:6.18::el9 |
||
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 |
Unaffected:
0:8.14.1-1.el9sat , < *
(rpm)
cpe:/a:redhat:satellite:6.19::el9 cpe:/a:redhat:satellite_capsule:6.19::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.12 |
Unaffected:
1786628667 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.12::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.13 |
Unaffected:
1786628681 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.13::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.14 |
Unaffected:
1786533561 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.14::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.15 |
Unaffected:
1786533565 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.15::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.16 |
Unaffected:
1787125166 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.16::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.17 |
Unaffected:
1787124635 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.17::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.18 |
Unaffected:
1787125069 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.18::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.19 |
Unaffected:
1787124632 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.19::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.20 |
Unaffected:
1787124925 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.20::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.21 |
Unaffected:
1787125311 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.21::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.22 |
Unaffected:
1787124779 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.22::el9 |
||
| Red Hat | Red Hat Offline Knowledge Portal 1.2.12 |
Unaffected:
1779996999 , < *
(rpm)
cpe:/a:redhat:offline_knowledge_portal:1.2::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 |
Unaffected:
1776716842 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.27::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 |
Unaffected:
1776717247 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.27::el9 |
||
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools
|
||
| Red Hat | Red Hat AMQ Broker 7 |
cpe:/a:redhat:amq_broker:7
|
||
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 |
cpe:/a:redhat:camel_quarkus:3
|
||
| Red Hat | Red Hat build of Apicurio Registry 2 |
cpe:/a:redhat:service_registry:2
|
||
| Red Hat | Red Hat build of Apicurio Registry 3 |
cpe:/a:redhat:apicurio_registry:3
|
||
| Red Hat | Red Hat build of Debezium 2 |
cpe:/a:redhat:debezium:2
|
||
| Red Hat | Red Hat build of Debezium 3 |
cpe:/a:redhat:debezium:3
|
||
| Red Hat | Red Hat Data Grid 8 |
cpe:/a:redhat:jboss_data_grid:8
|
||
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 |
cpe:/a:redhat:jboss_enterprise_application_platform:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
||
| Red Hat | Red Hat JBoss Web Server 6 |
cpe:/a:redhat:jboss_enterprise_web_server:6
|
||
| Red Hat | Red Hat Process Automation 7 |
cpe:/a:redhat:jboss_enterprise_bpms_platform:7
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
||
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
||
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2332",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T03:58:12.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4.4::el9"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "HawtIO HawtIO 4.4.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7.13"
],
"defaultStatus": "unaffected",
"product": "Red Hat AMQ Broker 7.13.5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_quarkus:3.33"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"packageName": "jmc",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.2.0-19.el9_8.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.16::el8",
"cpe:/a:redhat:satellite_capsule:6.16::el8"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.16 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el8sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.16::el9",
"cpe:/a:redhat:satellite_capsule:6.16::el9"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.16 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el9sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.17::el9",
"cpe:/a:redhat:satellite_capsule:6.17::el9"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.17 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el9sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9",
"cpe:/a:redhat:satellite_capsule:6.18::el9"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.18 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el9sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.19::el9",
"cpe:/a:redhat:satellite_capsule:6.19::el9"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.19 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el9sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628667",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.13::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628681",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.14::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533561",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.15::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533565",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125166",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124635",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125069",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124632",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124925",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125311",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124779",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:offline_knowledge_portal:1.2::el9"
],
"defaultStatus": "affected",
"packageName": "offline-knowledge-portal/rhokp-rhel9",
"product": "Red Hat Offline Knowledge Portal 1.2.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779996999",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/openvsx-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776716842",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/pluginregistry-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776717247",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "jenkins",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:2"
],
"defaultStatus": "unknown",
"packageName": "jetty-http",
"product": "Red Hat build of Debezium 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_web_server:6"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat JBoss Web Server 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "puppetserver",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "satellite-capsule:el8/puppetserver",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-14T10:59:10.193Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T12:05:05.077Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"name": "RHBZ#2458187",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20568"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22453"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:50223: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:50222: Red Hat Satellite 6.17 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:50263: Red Hat Satellite 6.18 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:50221: Red Hat Satellite 6.19 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:20568: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25089: HawtIO HawtIO 4.4.0"
},
{
"lang": "en",
"value": "RHSA-2026:60247: OpenShift Developer Tools and Services 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:60249: OpenShift Developer Tools and Services 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:60248: OpenShift Developer Tools and Services 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:60239: OpenShift Developer Tools and Services 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:60251: OpenShift Developer Tools and Services 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:60246: OpenShift Developer Tools and Services 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:60250: OpenShift Developer Tools and Services 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:60252: OpenShift Developer Tools and Services 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:60259: OpenShift Developer Tools and Services 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:60254: OpenShift Developer Tools and Services 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:60256: OpenShift Developer Tools and Services 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:14272: Red Hat AMQ Broker 7.13.5"
},
{
"lang": "en",
"value": "RHSA-2026:22453: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
},
{
"lang": "en",
"value": "RHSA-2026:21773: Red Hat Offline Knowledge Portal 1.2.12"
},
{
"lang": "en",
"value": "RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27"
},
{
"lang": "en",
"value": "RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-14T12:01:05.768Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-14T10:59:10.193Z",
"value": "Made public."
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"workarounds": [
{
"lang": "en",
"value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "pkg://maven/org.eclipse.jetty/jetty-http",
"product": "Eclipse Jetty",
"repo": "https://github.com/jetty/jetty.project",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.6",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.32",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.0.28",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.0.27",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.59",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/xclow3n"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\u003cbr\u003e\u003cul\u003e\u003cli\u003e\u003cspan\u003ehttps://w4ke.info/2025/06/18/funky-chunks.html\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003ehttps://w4ke.info/2025/10/29/funky-chunks-2.html\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003eJetty terminates chunk extension parsing at\u0026nbsp;\u003ccode\u003e\\r\\n\u003c/code\u003e\u0026nbsp;inside quoted strings instead of treating this as an error.\u003cbr\u003e\u003cbr\u003e\n\u003cpre\u003ePOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\u003c/pre\u003e\n\n\u003cdiv\u003e\u003cbr\u003eNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.\u003cbr\u003e\u003c/div\u003e"
}
],
"value": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n * https://w4ke.info/2025/06/18/funky-chunks.html\n\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at\u00a0\\r\\n\u00a0inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:04:06.097Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"tags": [
"issue-tracking"
],
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTTP Request Smuggling via Chunked Extension Quoted-String Parsing",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-2332",
"datePublished": "2026-04-14T10:59:10.193Z",
"dateReserved": "2026-02-11T09:56:25.879Z",
"dateUpdated": "2026-09-10T12:05:05.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-2332",
"date": "2026-09-10",
"epss": "0.01305",
"percentile": "0.68839"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-2332\",\"sourceIdentifier\":\"emo@eclipse.org\",\"published\":\"2026-04-14T12:16:21.333\",\"lastModified\":\"2026-09-10T13:18:03.987\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \\\"funky chunks\\\" techniques outlined here:\\n * https://w4ke.info/2025/06/18/funky-chunks.html\\n\\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\\n\\n\\nJetty terminates chunk extension parsing at\u00a0\\\\r\\\\n\u00a0inside quoted strings instead of treating this as an error.\\n\\n\\n\\n\\nPOST / HTTP/1.1\\nHost: localhost\\nTransfer-Encoding: chunked\\n\\n1;ext=\\\"val\\nX\\n0\\n\\nGET /smuggled HTTP/1.1\\n...\\n\\n\\n\\n\\n\\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.\"}],\"affected\":[{\"source\":\"emo@eclipse.org\",\"affectedData\":[{\"vendor\":\"Eclipse Foundation\",\"product\":\"Eclipse Jetty\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"packageName\":\"pkg://maven/org.eclipse.jetty/jetty-http\",\"repo\":\"https://github.com/jetty/jetty.project\",\"versions\":[{\"version\":\"12.1.0\",\"lessThanOrEqual\":\"12.1.6\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"12.0.0\",\"lessThanOrEqual\":\"12.0.32\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"11.0.0\",\"lessThanOrEqual\":\"11.0.28\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"10.0.0\",\"lessThanOrEqual\":\"10.0.27\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"9.4.0\",\"lessThanOrEqual\":\"9.4.59\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"HawtIO HawtIO 4.4.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:apache_camel_hawtio:4.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7.13.5\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7.13\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:apache_camel_quarkus:3.33\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jmc\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::crb\"],\"versions\":[{\"version\":\"0:8.2.0-19.el9_8.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el8\",\"cpe:/a:redhat:satellite_capsule:6.16::el8\"],\"versions\":[{\"version\":\"0:8.14.1-1.el8sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el9\",\"cpe:/a:redhat:satellite_capsule:6.16::el9\"],\"versions\":[{\"version\":\"0:8.14.1-1.el9sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.17 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.17::el9\",\"cpe:/a:redhat:satellite_capsule:6.17::el9\"],\"versions\":[{\"version\":\"0:8.14.1-1.el9sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\",\"cpe:/a:redhat:satellite_capsule:6.18::el9\"],\"versions\":[{\"version\":\"0:8.14.1-1.el9sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.19 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.19::el9\",\"cpe:/a:redhat:satellite_capsule:6.19::el9\"],\"versions\":[{\"version\":\"0:8.14.1-1.el9sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.12::el8\"],\"versions\":[{\"version\":\"1786628667\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.13::el8\"],\"versions\":[{\"version\":\"1786628681\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.14::el8\"],\"versions\":[{\"version\":\"1786533561\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.15::el8\"],\"versions\":[{\"version\":\"1786533565\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.16::el9\"],\"versions\":[{\"version\":\"1787125166\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.17::el9\"],\"versions\":[{\"version\":\"1787124635\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.18::el9\"],\"versions\":[{\"version\":\"1787125069\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.19::el9\"],\"versions\":[{\"version\":\"1787124632\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.20::el9\"],\"versions\":[{\"version\":\"1787124925\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.21::el9\"],\"versions\":[{\"version\":\"1787125311\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.22::el9\"],\"versions\":[{\"version\":\"1787124779\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Offline Knowledge Portal 1.2.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"offline-knowledge-portal/rhokp-rhel9\",\"cpes\":[\"cpe:/a:redhat:offline_knowledge_portal:1.2::el9\"],\"versions\":[{\"version\":\"1779996999\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.27\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/openvsx-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"],\"versions\":[{\"version\":\"1776716842\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.27\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/pluginregistry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"],\"versions\":[{\"version\":\"1776717247\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jenkins\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:service_registry:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:debezium:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Web Server 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_web_server:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"puppetserver\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite-capsule:el8/puppetserver\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"emo@eclipse.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-14T00:00:00+00:00\",\"id\":\"CVE-2026-2332\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"emo@eclipse.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.4.0\",\"versionEndExcluding\":\"9.4.60\",\"matchCriteriaId\":\"E0FB149B-EF33-4A51-9B96-030899E250CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.0.28\",\"matchCriteriaId\":\"361D419A-7A89-439A-99B1-D34E9914BAE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndExcluding\":\"11.0.28\",\"matchCriteriaId\":\"7020D8E5-61DD-4DB6-82E4-EA46A96838A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.0.0\",\"versionEndExcluding\":\"12.0.33\",\"matchCriteriaId\":\"E1A6095F-3D1E-40CB-A875-D41BF6C73EB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.1.0\",\"versionEndExcluding\":\"12.1.7\",\"matchCriteriaId\":\"B5A32954-7B03-46B6-9956-54BE0F8477E8\"}]}]}],\"references\":[{\"url\":\"https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf\",\"source\":\"emo@eclipse.org\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://gitlab.eclipse.org/security/cve-assignment/-/issues/89\",\"source\":\"emo@eclipse.org\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10175\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14272\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17668\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20568\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21773\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22453\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25089\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50221\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50222\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50223\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50263\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60239\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60246\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60247\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60248\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60249\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60251\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60252\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60254\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60256\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60259\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-2332\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2458187\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-09-09T22:24:37+00:00",
"cve": "CVE-2026-2332",
"id": "CVE-2026-2332",
"initial_release_date": "2026-04-14T10:59:10.193000+00:00",
"product_status:fixed": "74",
"product_status:known_affected": "14",
"product_status:known_not_affected": "451",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:apache_camel_hawtio:4.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"HawtIO HawtIO 4.4.0\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7.13\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7.13.5\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_quarkus:3.33\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.2.0-19.el9_8.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"jmc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el8\", \"cpe:/a:redhat:satellite_capsule:6.16::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el8sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el9\", \"cpe:/a:redhat:satellite_capsule:6.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_capsule:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\", \"cpe:/a:redhat:satellite_capsule:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.19::el9\", \"cpe:/a:redhat:satellite_capsule:6.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.19 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628667\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.13::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628681\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.14::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533561\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533565\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125166\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124635\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125069\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124632\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.20\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124925\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.21\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125311\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124779\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:offline_knowledge_portal:1.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Offline Knowledge Portal 1.2.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779996999\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"offline-knowledge-portal/rhokp-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.27\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776716842\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/openvsx-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.27\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776717247\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/pluginregistry-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"jenkins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_registry:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 2\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 2\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_web_server:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Web Server 6\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"puppetserver\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite-capsule:el8/puppetserver\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-14T12:01:05.768Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-14T10:59:10.193Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:50223: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50222: Red Hat Satellite 6.17 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50263: Red Hat Satellite 6.18 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50221: Red Hat Satellite 6.19 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20568: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25089: HawtIO HawtIO 4.4.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60247: OpenShift Developer Tools and Services 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60249: OpenShift Developer Tools and Services 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60248: OpenShift Developer Tools and Services 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60239: OpenShift Developer Tools and Services 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60251: OpenShift Developer Tools and Services 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60246: OpenShift Developer Tools and Services 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60250: OpenShift Developer Tools and Services 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60252: OpenShift Developer Tools and Services 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60259: OpenShift Developer Tools and Services 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60254: OpenShift Developer Tools and Services 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60256: OpenShift Developer Tools and Services 4.22\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14272: Red Hat AMQ Broker 7.13.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22453: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21773: Red Hat Offline Knowledge Portal 1.2.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-14T10:59:10.193Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-2332\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2458187\", \"name\": \"RHBZ#2458187\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50223\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50222\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50263\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50221\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20568\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25089\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60247\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60249\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60248\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60239\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60251\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60246\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60250\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60252\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60259\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60254\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60256\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14272\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22453\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21773\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10175\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17668\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-444\", \"description\": \"Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-09-10T12:05:05.077Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-2332\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-14T13:06:34.622366Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-14T13:08:48.379Z\"}}], \"cna\": {\"title\": \"HTTP Request Smuggling via Chunked Extension Quoted-String Parsing\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"https://github.com/xclow3n\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/jetty/jetty.project\", \"vendor\": \"Eclipse Foundation\", \"product\": \"Eclipse Jetty\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.1.6\"}, {\"status\": \"affected\", \"version\": \"12.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.0.32\"}, {\"status\": \"affected\", \"version\": \"11.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"11.0.28\"}, {\"status\": \"affected\", \"version\": \"10.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"10.0.27\"}, {\"status\": \"affected\", \"version\": \"9.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"9.4.59\"}], \"packageName\": \"pkg://maven/org.eclipse.jetty/jetty-http\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://gitlab.eclipse.org/security/cve-assignment/-/issues/89\", \"tags\": [\"issue-tracking\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \\\"funky chunks\\\" techniques outlined here:\\n * https://w4ke.info/2025/06/18/funky-chunks.html\\n\\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\\n\\n\\nJetty terminates chunk extension parsing at\\u00a0\\\\r\\\\n\\u00a0inside quoted strings instead of treating this as an error.\\n\\n\\n\\n\\nPOST / HTTP/1.1\\nHost: localhost\\nTransfer-Encoding: chunked\\n\\n1;ext=\\\"val\\nX\\n0\\n\\nGET /smuggled HTTP/1.1\\n...\\n\\n\\n\\n\\n\\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \\\"funky chunks\\\" techniques outlined here:\u003cbr\u003e\u003cul\u003e\u003cli\u003e\u003cspan\u003ehttps://w4ke.info/2025/06/18/funky-chunks.html\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003ehttps://w4ke.info/2025/10/29/funky-chunks-2.html\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003eJetty terminates chunk extension parsing at\u0026nbsp;\u003ccode\u003e\\\\r\\\\n\u003c/code\u003e\u0026nbsp;inside quoted strings instead of treating this as an error.\u003cbr\u003e\u003cbr\u003e\\n\u003cpre\u003ePOST / HTTP/1.1\\nHost: localhost\\nTransfer-Encoding: chunked\\n\\n1;ext=\\\"val\\nX\\n0\\n\\nGET /smuggled HTTP/1.1\\n...\\n\u003c/pre\u003e\\n\\n\u003cdiv\u003e\u003cbr\u003eNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.\u003cbr\u003e\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-444\", \"description\": \"CWE-444 Inconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"e51fbebd-6053-4e49-959f-1b94eeb69a2c\", \"shortName\": \"eclipse\", \"dateUpdated\": \"2026-08-17T15:04:06.097Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-2332\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-10T12:05:05.077Z\", \"dateReserved\": \"2026-02-11T09:56:25.879Z\", \"assignerOrgId\": \"e51fbebd-6053-4e49-959f-1b94eeb69a2c\", \"datePublished\": \"2026-04-14T10:59:10.193Z\", \"assignerShortName\": \"eclipse\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:50223
Vulnerability from csaf_redhat - Published: 2026-08-04 16:04 - Updated: 2026-09-10 10:01Summary
Red Hat Security Advisory: Satellite 6.16.12 Async Update
Severity
Important
Notes
Topic: An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* puppet-agent: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230)
* puppetserver: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)
* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)
* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)
* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)
* python-pillow: Pillow: Native heap out-of-bounds write (CVE-2026-59197)
* python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)
* rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-em_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-em_synchrony: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-excon: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-httpclient: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday_middleware: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-multipart: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-net_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-net_http_persistent: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-patron: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-rack: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-retry: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515)
* rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236)
* libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864)
Bug Fix(es):
* scap-security-guide-satellite: Update of scap-security-guide-satellite package sources
* 'Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence "container_blobmanifest_id_seq"' during container image sync
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).
5.6 (Medium)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
146 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
146 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.
4.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
150 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
Known not affected
142 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Threats
Impact
Important
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.
7.8 (High)
Affected products
Fixed
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
134 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.
7.5 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
138 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.
7.5 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
Known not affected
138 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Threats
Impact
Important
A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application to build an excessively deep data structure. This can lead to a SystemStackError, resulting in a Denial of Service (DoS) by crashing the application's processing thread or worker.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
146 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
138 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.
7.5 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
138 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Document#encoding= function, the library frees the document's current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a denial of service (DoS) due to a segmentation fault or information disclosure by leaking freed memory into a Ruby String.
6.5 (Medium)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
138 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed integer arithmetic. This can lead to denial of service and limited integrity impact via heap corruption.
8.2 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
Known not affected
138 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Threats
Impact
Important
References
83 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Satellite is a system management solution that allows organizations\nto configure and maintain their systems without the necessity to provide\npublic Internet access to their servers or other client systems. It\nperforms provisioning and configuration management of predefined standard\noperating environments.\n\nSecurity Fix(es):\n\n* puppet-agent: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230)\n\n* puppetserver: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)\n\n* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)\n\n* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)\n\n* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)\n\n* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)\n\n* python-pillow: Pillow: Native heap out-of-bounds write (CVE-2026-59197)\n\n* python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)\n\n* rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-em_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-em_synchrony: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-excon: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-httpclient: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday_middleware: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-multipart: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-net_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-net_http_persistent: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-patron: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-rack: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-faraday-retry: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515)\n\n* rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236)\n\n* libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864)\n\nBug Fix(es):\n\n* scap-security-guide-satellite: Update of scap-security-guide-satellite package sources\n\n* \u0027Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence \"container_blobmanifest_id_seq\"\u0027 during container image sync",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50223",
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2396054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
},
{
"category": "external",
"summary": "2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "2460425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460425"
},
{
"category": "external",
"summary": "2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "2489812",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489812"
},
{
"category": "external",
"summary": "2492252",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492252"
},
{
"category": "external",
"summary": "2492952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492952"
},
{
"category": "external",
"summary": "2497452",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
},
{
"category": "external",
"summary": "2497455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
},
{
"category": "external",
"summary": "2497464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497464"
},
{
"category": "external",
"summary": "2497466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
},
{
"category": "external",
"summary": "2500043",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500043"
},
{
"category": "external",
"summary": "SAT-44868",
"url": "https://issues.redhat.com/browse/SAT-44868"
},
{
"category": "external",
"summary": "SAT-48146",
"url": "https://issues.redhat.com/browse/SAT-48146"
},
{
"category": "external",
"summary": "SAT-48289",
"url": "https://issues.redhat.com/browse/SAT-48289"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50223.json"
}
],
"title": "Red Hat Security Advisory: Satellite 6.16.12 Async Update",
"tracking": {
"current_release_date": "2026-09-10T10:01:05+00:00",
"generator": {
"date": "2026-09-10T10:01:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:50223",
"initial_release_date": "2026-08-04T16:04:50+00:00",
"revision_history": [
{
"date": "2026-08-04T16:04:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-04T16:04:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T10:01:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.16::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_capsule:6.16::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-maintenance",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_maintenance:6.16::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-utils",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_utils:6.16::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.16::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_capsule:6.16::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-maintenance",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_maintenance:6.16::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-utils",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_utils:6.16::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite 6"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"product": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"product_id": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_maintain@1.7.15-1.el8sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-1:3.12.0.8-1.el8sat.src",
"product": {
"name": "foreman-installer-1:3.12.0.8-1.el8sat.src",
"product_id": "foreman-installer-1:3.12.0.8-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.12.0.8-1.el8sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el8sat.src",
"product": {
"name": "openvox-server-0:8.14.1-1.el8sat.src",
"product_id": "openvox-server-0:8.14.1-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "openvox-agent-0:8.24.1-3.el8sat.src",
"product": {
"name": "openvox-agent-0:8.24.1-3.el8sat.src",
"product_id": "openvox-agent-0:8.24.1-3.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-agent@8.24.1-3.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.14.0.21-1.el8sat.src",
"product": {
"name": "rubygem-katello-0:4.14.0.21-1.el8sat.src",
"product_id": "rubygem-katello-0:4.14.0.21-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.14.0.21-1.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el8sat.src",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el8sat.src",
"product_id": "rubygem-faraday-0:1.10.6-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pyjwt-0:2.13.0-1.el8pc.src",
"product": {
"name": "python-pyjwt-0:2.13.0-1.el8pc.src",
"product_id": "python-pyjwt-0:2.13.0-1.el8pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pyjwt@2.13.0-1.el8pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pillow-0:12.3.0-1.el8pc.src",
"product": {
"name": "python-pillow-0:12.3.0-1.el8pc.src",
"product_id": "python-pillow-0:12.3.0-1.el8pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow@12.3.0-1.el8pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"product": {
"name": "rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"product_id": "rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.15.7-3.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.16.12-1.el8sat.src",
"product": {
"name": "satellite-0:6.16.12-1.el8sat.src",
"product_id": "satellite-0:6.16.12-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.16.12-1.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pulp-container-0:2.20.10-2.el8pc.src",
"product": {
"name": "python-pulp-container-0:2.20.10-2.el8pc.src",
"product_id": "python-pulp-container-0:2.20.10-2.el8pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pulp-container@2.20.10-2.el8pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysequoia-0:0.1.33-1.el8pc.src",
"product": {
"name": "python-pysequoia-0:0.1.33-1.el8pc.src",
"product_id": "python-pysequoia-0:0.1.33-1.el8pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysequoia@0.1.33-1.el8pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "libsolv-1:0.7.20-7.el8sat.src",
"product": {
"name": "libsolv-1:0.7.20-7.el8sat.src",
"product_id": "libsolv-1:0.7.20-7.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsolv@0.7.20-7.el8sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"product": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"product_id": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_maintain@1.7.15-1.el9sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-1:3.12.0.8-1.el9sat.src",
"product": {
"name": "foreman-installer-1:3.12.0.8-1.el9sat.src",
"product_id": "foreman-installer-1:3.12.0.8-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.12.0.8-1.el9sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el9sat.src",
"product": {
"name": "openvox-server-0:8.14.1-1.el9sat.src",
"product_id": "openvox-server-0:8.14.1-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "openvox-agent-0:8.24.1-3.el9sat.src",
"product": {
"name": "openvox-agent-0:8.24.1-3.el9sat.src",
"product_id": "openvox-agent-0:8.24.1-3.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-agent@8.24.1-3.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.14.0.21-1.el9sat.src",
"product": {
"name": "rubygem-katello-0:4.14.0.21-1.el9sat.src",
"product_id": "rubygem-katello-0:4.14.0.21-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.14.0.21-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product_id": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pyjwt-0:2.13.0-1.el9pc.src",
"product": {
"name": "python-pyjwt-0:2.13.0-1.el9pc.src",
"product_id": "python-pyjwt-0:2.13.0-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pyjwt@2.13.0-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pillow-0:12.3.0-1.el9pc.src",
"product": {
"name": "python-pillow-0:12.3.0-1.el9pc.src",
"product_id": "python-pillow-0:12.3.0-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow@12.3.0-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"product": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"product_id": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.15.7-3.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.16.12-1.el9sat.src",
"product": {
"name": "satellite-0:6.16.12-1.el9sat.src",
"product_id": "satellite-0:6.16.12-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.16.12-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pulp-container-0:2.20.10-2.el9pc.src",
"product": {
"name": "python-pulp-container-0:2.20.10-2.el9pc.src",
"product_id": "python-pulp-container-0:2.20.10-2.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pulp-container@2.20.10-2.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysequoia-0:0.1.33-1.el9pc.src",
"product": {
"name": "python-pysequoia-0:0.1.33-1.el9pc.src",
"product_id": "python-pysequoia-0:0.1.33-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysequoia@0.1.33-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el9sat?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"product": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"product_id": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_maintain@1.7.15-1.el8sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"product": {
"name": "foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"product_id": "foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.12.0.8-1.el8sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"product": {
"name": "foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"product_id": "foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer-katello@3.12.0.8-1.el8sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el8sat.noarch",
"product": {
"name": "openvox-server-0:8.14.1-1.el8sat.noarch",
"product_id": "openvox-server-0:8.14.1-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"product": {
"name": "rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"product_id": "rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.14.0.21-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"product_id": "rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"product": {
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"product_id": "python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pyjwt%2Bcrypto@2.13.0-1.el8pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"product": {
"name": "python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"product_id": "python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pyjwt@2.13.0-1.el8pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-capsule-0:6.16.12-1.el8sat.noarch",
"product": {
"name": "satellite-capsule-0:6.16.12-1.el8sat.noarch",
"product_id": "satellite-capsule-0:6.16.12-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-capsule@6.16.12-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-common-0:6.16.12-1.el8sat.noarch",
"product": {
"name": "satellite-common-0:6.16.12-1.el8sat.noarch",
"product_id": "satellite-common-0:6.16.12-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-common@6.16.12-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.16.12-1.el8sat.noarch",
"product": {
"name": "satellite-0:6.16.12-1.el8sat.noarch",
"product_id": "satellite-0:6.16.12-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.16.12-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-cli-0:6.16.12-1.el8sat.noarch",
"product": {
"name": "satellite-cli-0:6.16.12-1.el8sat.noarch",
"product_id": "satellite-cli-0:6.16.12-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-cli@6.16.12-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"product": {
"name": "python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"product_id": "python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pulp-container@2.20.10-2.el8pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"product": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"product_id": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_maintain@1.7.15-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"product_id": "foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.12.0.8-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"product_id": "foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer-katello@3.12.0.8-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product_id": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"product": {
"name": "rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"product_id": "rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.14.0.21-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product_id": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"product": {
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"product_id": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pyjwt%2Bcrypto@2.13.0-1.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"product": {
"name": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"product_id": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pyjwt@2.13.0-1.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-capsule-0:6.16.12-1.el9sat.noarch",
"product": {
"name": "satellite-capsule-0:6.16.12-1.el9sat.noarch",
"product_id": "satellite-capsule-0:6.16.12-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-capsule@6.16.12-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-common-0:6.16.12-1.el9sat.noarch",
"product": {
"name": "satellite-common-0:6.16.12-1.el9sat.noarch",
"product_id": "satellite-common-0:6.16.12-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-common@6.16.12-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.16.12-1.el9sat.noarch",
"product": {
"name": "satellite-0:6.16.12-1.el9sat.noarch",
"product_id": "satellite-0:6.16.12-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.16.12-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-cli-0:6.16.12-1.el9sat.noarch",
"product": {
"name": "satellite-cli-0:6.16.12-1.el9sat.noarch",
"product_id": "satellite-cli-0:6.16.12-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-cli@6.16.12-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"product": {
"name": "python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"product_id": "python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pulp-container@2.20.10-2.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el9sat?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "openvox-agent-0:8.24.1-3.el8sat.x86_64",
"product": {
"name": "openvox-agent-0:8.24.1-3.el8sat.x86_64",
"product_id": "openvox-agent-0:8.24.1-3.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-agent@8.24.1-3.el8sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"product": {
"name": "python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"product_id": "python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pillow@12.3.0-1.el8pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"product": {
"name": "python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"product_id": "python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@12.3.0-1.el8pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"product": {
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"product_id": "python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pillow-debuginfo@12.3.0-1.el8pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"product": {
"name": "rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"product_id": "rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.15.7-3.el8sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"product_id": "rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debugsource@1.15.7-3.el8sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"product_id": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.15.7-3.el8sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"product": {
"name": "python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"product_id": "python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pysequoia@0.1.33-1.el8pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libsolv-1:0.7.20-7.el8sat.x86_64",
"product": {
"name": "libsolv-1:0.7.20-7.el8sat.x86_64",
"product_id": "libsolv-1:0.7.20-7.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsolv@0.7.20-7.el8sat?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "python3-solv-1:0.7.20-7.el8sat.x86_64",
"product": {
"name": "python3-solv-1:0.7.20-7.el8sat.x86_64",
"product_id": "python3-solv-1:0.7.20-7.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-solv@0.7.20-7.el8sat?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"product": {
"name": "libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"product_id": "libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsolv-debugsource@0.7.20-7.el8sat?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product": {
"name": "libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_id": "libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsolv-debuginfo@0.7.20-7.el8sat?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product": {
"name": "libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_id": "libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsolv-demo-debuginfo@0.7.20-7.el8sat?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product": {
"name": "libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_id": "libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsolv-tools-debuginfo@0.7.20-7.el8sat?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product": {
"name": "perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_id": "perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/perl-solv-debuginfo@0.7.20-7.el8sat?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product": {
"name": "python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_id": "python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-solv-debuginfo@0.7.20-7.el8sat?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product": {
"name": "ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_id": "ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby-solv-debuginfo@0.7.20-7.el8sat?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"product": {
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"product_id": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-agent@8.24.1-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pillow@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product_id": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pillow-debuginfo@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.15.7-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debugsource@1.15.7-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.15.7-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"product": {
"name": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"product_id": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pysequoia@0.1.33-1.el9pc?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.12.0.8-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch"
},
"product_reference": "foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.12.0.8-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src"
},
"product_reference": "foreman-installer-1:3.12.0.8-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-1:0.7.20-7.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src"
},
"product_reference": "libsolv-1:0.7.20-7.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src"
},
"product_reference": "openvox-agent-0:8.24.1-3.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64"
},
"product_reference": "openvox-agent-0:8.24.1-3.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:12.3.0-1.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src"
},
"product_reference": "python-pillow-0:12.3.0-1.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64"
},
"product_reference": "python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulp-container-0:2.20.10-2.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src"
},
"product_reference": "python-pulp-container-0:2.20.10-2.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pyjwt-0:2.13.0-1.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src"
},
"product_reference": "python-pyjwt-0:2.13.0-1.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysequoia-0:0.1.33-1.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src"
},
"product_reference": "python-pysequoia-0:0.1.33-1.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-solv-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "python3-solv-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-0:12.3.0-1.el8pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64"
},
"product_reference": "python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64"
},
"product_reference": "python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulp-container-0:2.20.10-2.el8pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch"
},
"product_reference": "python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch"
},
"product_reference": "python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt-0:2.13.0-1.el8pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch"
},
"product_reference": "python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64"
},
"product_reference": "python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.12-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src"
},
"product_reference": "satellite-0:6.16.12-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.16.12-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch"
},
"product_reference": "satellite-capsule-0:6.16.12-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.16.12-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch"
},
"product_reference": "satellite-common-0:6.16.12-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-maintenance"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-maintenance"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.12-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src"
},
"product_reference": "satellite-0:6.16.12-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.16.12-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch"
},
"product_reference": "satellite-cli-0:6.16.12-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.12.0.8-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch"
},
"product_reference": "foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.12.0.8-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src"
},
"product_reference": "foreman-installer-1:3.12.0.8-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-1:0.7.20-7.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src"
},
"product_reference": "libsolv-1:0.7.20-7.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-debugsource-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src"
},
"product_reference": "openvox-agent-0:8.24.1-3.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64"
},
"product_reference": "openvox-agent-0:8.24.1-3.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:12.3.0-1.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src"
},
"product_reference": "python-pillow-0:12.3.0-1.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64"
},
"product_reference": "python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulp-container-0:2.20.10-2.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src"
},
"product_reference": "python-pulp-container-0:2.20.10-2.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pyjwt-0:2.13.0-1.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src"
},
"product_reference": "python-pyjwt-0:2.13.0-1.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysequoia-0:0.1.33-1.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src"
},
"product_reference": "python-pysequoia-0:0.1.33-1.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-solv-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "python3-solv-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-0:12.3.0-1.el8pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64"
},
"product_reference": "python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64"
},
"product_reference": "python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulp-container-0:2.20.10-2.el8pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch"
},
"product_reference": "python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch"
},
"product_reference": "python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt-0:2.13.0-1.el8pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch"
},
"product_reference": "python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64"
},
"product_reference": "python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64"
},
"product_reference": "ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.14.0.21-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch"
},
"product_reference": "rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.14.0.21-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src"
},
"product_reference": "rubygem-katello-0:4.14.0.21-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.12-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch"
},
"product_reference": "satellite-0:6.16.12-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.12-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src"
},
"product_reference": "satellite-0:6.16.12-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.16.12-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch"
},
"product_reference": "satellite-cli-0:6.16.12-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.16.12-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch"
},
"product_reference": "satellite-common-0:6.16.12-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.12.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.12.0.8-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src"
},
"product_reference": "foreman-installer-1:3.12.0.8-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:12.3.0-1.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src"
},
"product_reference": "python-pillow-0:12.3.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulp-container-0:2.20.10-2.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src"
},
"product_reference": "python-pulp-container-0:2.20.10-2.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pyjwt-0:2.13.0-1.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src"
},
"product_reference": "python-pyjwt-0:2.13.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysequoia-0:0.1.33-1.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src"
},
"product_reference": "python-pysequoia-0:0.1.33-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulp-container-0:2.20.10-2.el9pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch"
},
"product_reference": "python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64"
},
"product_reference": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.12-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src"
},
"product_reference": "satellite-0:6.16.12-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.16.12-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch"
},
"product_reference": "satellite-capsule-0:6.16.12-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.16.12-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.16.12-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-maintenance"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-maintenance"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.12-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src"
},
"product_reference": "satellite-0:6.16.12-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.16.12-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.16.12-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.12.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.12.0.8-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src"
},
"product_reference": "foreman-installer-1:3.12.0.8-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:12.3.0-1.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src"
},
"product_reference": "python-pillow-0:12.3.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulp-container-0:2.20.10-2.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src"
},
"product_reference": "python-pulp-container-0:2.20.10-2.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pyjwt-0:2.13.0-1.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src"
},
"product_reference": "python-pyjwt-0:2.13.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysequoia-0:0.1.33-1.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src"
},
"product_reference": "python-pysequoia-0:0.1.33-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulp-container-0:2.20.10-2.el9pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch"
},
"product_reference": "python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64"
},
"product_reference": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.14.0.21-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch"
},
"product_reference": "rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.14.0.21-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src"
},
"product_reference": "rubygem-katello-0:4.14.0.21-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.12-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch"
},
"product_reference": "satellite-0:6.16.12-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.12-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src"
},
"product_reference": "satellite-0:6.16.12-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.16.12-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.16.12-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.16.12-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.16.12-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-9230",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2025-09-17T12:15:34.387000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2396054"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability was rated as Moderate because, while the potential impact includes an application level denial of service and possible arbitrary code execution, successful exploitation is considered unlikely due to the high attack complexity and the fact that password-based CMS encryption (PWRI) is rarely used in real-world deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9230"
},
{
"category": "external",
"summary": "RHBZ#2396054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230"
}
],
"release_date": "2025-09-30T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-12515",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-06-17T11:37:24.783000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2489812"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Katello\u0027s of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "katello: missing repository authorization in content_uploads exposes cross-product content existence",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects Katello\u0027s content upload API authorization handling. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability.\n\nKatello\u0027s content_uploads API does not properly enforce repository authorization checks when processing upload requests. A user with product-filtered edit_products permissions may query repositories outside their authorized scope and determine whether matching content exists within the Pulp content store.\n\nThe issue arises because the API allows operations against repositories that are not covered by the caller\u0027s product-scoped permissions. The response behavior may disclose whether matching content already exists, potentially revealing information about content associated with repositories that would otherwise be inaccessible to the user.\n\nBecause the impact is limited to disclosure of repository information, Red Hat assessed the Confidentiality impact as Low (C:L), with no demonstrated Integrity or Availability impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12515"
},
{
"category": "external",
"summary": "RHBZ#2489812",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489812"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12515"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12515",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12515"
},
{
"category": "external",
"summary": "https://github.com/Katello/katello/pull/11712",
"url": "https://github.com/Katello/katello/pull/11712"
}
],
"release_date": "2026-06-17T15:27:46.078000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "katello: missing repository authorization in content_uploads exposes cross-product content existence"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-48864",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-21T23:19:41+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460425"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This heap buffer overflow in libsolv\u0027s page decompression logic can lead to out-of-bounds reads and writes when processing specially crafted `.solv` files. Exploitation requires a victim application to ingest malicious repository metadata, limiting the attack vector to scenarios involving user interaction or untrusted content sources. Given the user interaction needed, Red Hat Product Security has rated this vulnerability as having a impact of Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"category": "external",
"summary": "RHBZ#2460425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48864"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864"
}
],
"release_date": "2026-05-26T16:07:55.363000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data"
},
{
"cve": "CVE-2026-54059",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-06T20:02:21.640821+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Python Pillow library. The PcfFontFile._load_bitmaps() method reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(). This allows crafted PCF font data to cause excessive memory allocation, leading to a denial of service condition. An attacker could exploit this by providing a specially crafted PCF font file to an application that uses Pillow\u0027s font loading functionality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54059"
},
{
"category": "external",
"summary": "RHBZ#2497464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"
}
],
"release_date": "2026-07-06T18:46:09.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "workaround",
"details": "Do not load PCF fonts from untrusted sources. If PCF font loading is required, validate font file dimensions before passing them to Pillow, or upgrade to Pillow 12.3.0 or later which includes the fix for this vulnerability.",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted PCF font data"
},
{
"cve": "CVE-2026-54060",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-07-06T20:02:29.509113+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497466"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library\u0027s font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Pillow prior to version 12.3.0. The FontFile.compile() method in PIL/FontFile.py assembles per-glyph images into a combined bitmap using Image.new() without calling Image._decompression_bomb_check(). This allows a specially crafted font file to trigger excessive memory allocation during conversion or saving, leading to denial of service via resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54060"
},
{
"category": "external",
"summary": "RHBZ#2497466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54060"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"
}
],
"release_date": "2026-07-06T18:49:23.788000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files"
},
{
"cve": "CVE-2026-54297",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-24T17:01:10.032866+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492252"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application to build an excessively deep data structure. This can lead to a SystemStackError, resulting in a Denial of Service (DoS) by crashing the application\u0027s processing thread or worker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "faraday: Faraday: Denial of Service via crafted nested query strings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as applications utilizing the Faraday HTTP client library in Red Hat products are susceptible to a denial of service. A remote attacker can send a specially crafted nested query string, causing the Faraday::NestedParamsEncoder to create an overly deep data structure. This unbounded recursion exhausts system resources, leading to a SystemStackError and crashing the application\u0027s processing thread.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54297"
},
{
"category": "external",
"summary": "RHBZ#2492252",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492252"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54297"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54297",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54297"
},
{
"category": "external",
"summary": "https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r",
"url": "https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r"
}
],
"release_date": "2026-06-24T15:50:08.949000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "faraday: Faraday: Denial of Service via crafted nested query strings"
},
{
"cve": "CVE-2026-55379",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-06T20:01:29.922515+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497452"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library\u0027s image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55379"
},
{
"category": "external",
"summary": "RHBZ#2497452",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"
}
],
"release_date": "2026-07-06T18:52:11.633000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "workaround",
"details": "Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected.",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted BDF font file"
},
{
"cve": "CVE-2026-55380",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-07-06T20:01:42.245051+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497455"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A denial-of-service vulnerability was found in Pillow\u0027s GdImageFile plugin. The GdImageFile._open() function reads image dimensions from GD 2.x file headers and stores them without performing a decompression bomb check. A crafted .gd file of approximately 1 KB can trigger an unchecked 4.3 GB C-heap allocation, potentially crashing the process or exhausting memory on systems with insufficient resources. This issue is fixed in Pillow 12.3.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55380"
},
{
"category": "external",
"summary": "RHBZ#2497455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55380"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",
"url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"
}
],
"release_date": "2026-07-06T18:50:14.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "workaround",
"details": "Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file"
},
{
"cve": "CVE-2026-57236",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-06-25T15:02:37.352778+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Document#encoding= function, the library frees the document\u0027s current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a denial of service (DoS) due to a segmentation fault or information disclosure by leaking freed memory into a Ruby String.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as Nokogiri\u0027s CRuby implementation in Red Hat products is vulnerable to a use-after-free when processing invalid encoding values. A remote unauthenticated attacker can trigger a segmentation fault causing denial of service, or leak freed memory contents into a Ruby String causing information disclosure, by providing crafted input that causes an invalid encoding to be set on a document.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57236"
},
{
"category": "external",
"summary": "RHBZ#2492952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57236"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57236",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57236"
},
{
"category": "external",
"summary": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p",
"url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p"
}
],
"release_date": "2026-06-25T14:29:14.181000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling"
},
{
"cve": "CVE-2026-59197",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-07-14T17:01:29.487456+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500043"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed integer arithmetic. This can lead to denial of service and limited integrity impact via heap corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Pillow: Pillow: Native heap out-of-bounds write",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Pillow\u0027s RankFilter API is vulnerable to a native heap out-of-bounds write when a caller supplies a very large odd filter size. Expansion runs before size validation and ImagingExpand uses unchecked signed integer arithmetic for output dimensions. A remote attacker who can drive RankFilter with attacker-controlled sizes may crash the process or corrupt heap memory. Fixed in Pillow 12.3.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59197"
},
{
"category": "external",
"summary": "RHBZ#2500043",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500043"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59197"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",
"url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/pull/9695",
"url": "https://github.com/python-pillow/Pillow/pull/9695"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
"url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"
}
],
"release_date": "2026-07-14T16:25:23.520000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:04:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16-capsule:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16-capsule:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16-capsule:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16-capsule:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el8sat.src",
"8Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el8sat.noarch",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.src",
"8Base-satellite-6.16:libsolv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-debugsource-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-demo-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:libsolv-tools-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.src",
"8Base-satellite-6.16:openvox-agent-0:8.24.1-3.el8sat.x86_64",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.noarch",
"8Base-satellite-6.16:openvox-server-0:8.14.1-1.el8sat.src",
"8Base-satellite-6.16:perl-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python-pillow-0:12.3.0-1.el8pc.src",
"8Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el8pc.src",
"8Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el8pc.src",
"8Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el8pc.src",
"8Base-satellite-6.16:python3-solv-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el8pc.x86_64",
"8Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el8pc.noarch",
"8Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el8pc.x86_64",
"8Base-satellite-6.16:ruby-solv-debuginfo-1:0.7.20-7.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el8sat.src",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el8sat.src",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.noarch",
"8Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.src",
"8Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el8sat.x86_64",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.12-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.12-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.noarch",
"8Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el8sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16-capsule:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16-maintenance:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:foreman-installer-1:3.12.0.8-1.el9sat.src",
"9Base-satellite-6.16:foreman-installer-katello-1:3.12.0.8-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.16:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.16:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.16:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.16:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python-pulp-container-0:2.20.10-2.el9pc.src",
"9Base-satellite-6.16:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.16:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.16:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.16:python3.11-pulp-container-0:2.20.10-2.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.16:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-foreman_maintain-1:1.7.15-1.el9sat.src",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.noarch",
"9Base-satellite-6.16:rubygem-katello-0:4.14.0.21-1.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.16:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.12-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.12-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.16:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Pillow: Pillow: Native heap out-of-bounds write"
}
]
}
RHSA-2026:50263
Vulnerability from csaf_redhat - Published: 2026-08-04 16:11 - Updated: 2026-09-10 10:01Summary
Red Hat Security Advisory: Satellite 6.18.8 Async Update
Severity
Important
Notes
Topic: A new release is now available for Red Hat Satellite 6.18 for RHEL 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* puppetserver: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)
* python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)
* rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515)
* rubygem-faraday-rack: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* python3.12-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
* python3.12-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)
* python3.12-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)
* python3.12-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)
* rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236)
* puppet-agent: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230)
Bug Fix(es):
* Backport OpenVox Server and Agent Packaging to Satellite and Capsule 6.18 (SAT-44866)
* Update of scap-security-guide-satellite package sources (SAT-48160)
* API endpoint GET /api/host_packages/installed_packages in apidoc is wrong (SAT-48161)
* Unable to save bookmark report under Hosts → All Hosts → Compliance → Reports (SAT-48162)
* 'Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence "container_blobmanifest_id_seq"' during container image sync (SAT-48302)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).
5.6 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
71 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
71 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.
4.3 (Medium)
Affected products
Fixed
2 products
Known not affected
73 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Vendor Fix
fix
|
Known not affected
69 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
67 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
Known not affected
67 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Threats
Impact
Important
A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application to build an excessively deep data structure. This can lead to a SystemStackError, resulting in a Denial of Service (DoS) by crashing the application's processing thread or worker.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
71 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
67 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
67 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Document#encoding= function, the library frees the document's current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a denial of service (DoS) due to a segmentation fault or information disclosure by leaking freed memory into a Ruby String.
6.5 (Medium)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
67 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
References
71 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new release is now available for Red Hat Satellite 6.18 for RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Satellite is a system management solution that allows organizations\nto configure and maintain their systems without the necessity to provide\npublic Internet access to their servers or other client systems. It\nperforms provisioning and configuration management of predefined standard\noperating environments.\n\nSecurity Fix(es):\n\n* puppetserver: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332) \n\n* python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)\n\n* rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515) \n\n* rubygem-faraday-rack: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* python3.12-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) \n\n* python3.12-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) \n\n* python3.12-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)\n\n* python3.12-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) \n\n* rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236)\n\n* puppet-agent: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230)\n\nBug Fix(es):\n\n* Backport OpenVox Server and Agent Packaging to Satellite and Capsule 6.18 (SAT-44866) \n\n* Update of scap-security-guide-satellite package sources (SAT-48160) \n\n* API endpoint GET /api/host_packages/installed_packages in apidoc is wrong (SAT-48161) \n\n* Unable to save bookmark report under Hosts \u2192 All Hosts \u2192 Compliance \u2192 Reports (SAT-48162)\n\n* \u0027Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence \"container_blobmanifest_id_seq\"\u0027 during container image sync (SAT-48302)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50263",
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2396054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
},
{
"category": "external",
"summary": "2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "2489812",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489812"
},
{
"category": "external",
"summary": "2492252",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492252"
},
{
"category": "external",
"summary": "2492952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492952"
},
{
"category": "external",
"summary": "2497452",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
},
{
"category": "external",
"summary": "2497455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
},
{
"category": "external",
"summary": "2497464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497464"
},
{
"category": "external",
"summary": "2497466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
},
{
"category": "external",
"summary": "SAT-44866",
"url": "https://issues.redhat.com/browse/SAT-44866"
},
{
"category": "external",
"summary": "SAT-48160",
"url": "https://issues.redhat.com/browse/SAT-48160"
},
{
"category": "external",
"summary": "SAT-48161",
"url": "https://issues.redhat.com/browse/SAT-48161"
},
{
"category": "external",
"summary": "SAT-48162",
"url": "https://issues.redhat.com/browse/SAT-48162"
},
{
"category": "external",
"summary": "SAT-48302",
"url": "https://issues.redhat.com/browse/SAT-48302"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50263.json"
}
],
"title": "Red Hat Security Advisory: Satellite 6.18.8 Async Update",
"tracking": {
"current_release_date": "2026-09-10T10:01:05+00:00",
"generator": {
"date": "2026-09-10T10:01:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:50263",
"initial_release_date": "2026-08-04T16:11:20+00:00",
"revision_history": [
{
"date": "2026-08-04T16:11:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-04T16:11:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T10:01:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.18 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.18::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.18 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_capsule:6.18::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.18 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-maintenance",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_maintenance:6.18::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.18 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-utils",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_utils:6.18::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite 6"
},
{
"branches": [
{
"category": "product_version",
"name": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"product": {
"name": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"product_id": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/pulpcore-obsolete-packages@1.3.1-3.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-1:3.16.0.9-1.el9sat.src",
"product": {
"name": "foreman-installer-1:3.16.0.9-1.el9sat.src",
"product_id": "foreman-installer-1:3.16.0.9-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.16.0.9-1.el9sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el9sat.src",
"product": {
"name": "openvox-server-0:8.14.1-1.el9sat.src",
"product_id": "openvox-server-0:8.14.1-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"product": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"product_id": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pillow@12.3.0-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"product": {
"name": "python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"product_id": "python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pulp-container@2.24.12-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"product": {
"name": "python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"product_id": "python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pyjwt@2.13.0-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"product": {
"name": "python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"product_id": "python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pysequoia@0.1.33-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product_id": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"product": {
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"product_id": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_maintain@1.13.10-1.el9sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"product": {
"name": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"product_id": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_openscap@11.1.2-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.18.0.15-1.el9sat.src",
"product": {
"name": "rubygem-katello-0:4.18.0.15-1.el9sat.src",
"product_id": "rubygem-katello-0:4.18.0.15-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.18.0.15-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"product": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"product_id": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.15.7-3.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.18.8-1.el9sat.src",
"product": {
"name": "satellite-0:6.18.8-1.el9sat.src",
"product_id": "satellite-0:6.18.8-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.18.8-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "openvox-agent-0:8.24.1-3.el9sat.src",
"product": {
"name": "openvox-agent-0:8.24.1-3.el9sat.src",
"product_id": "openvox-agent-0:8.24.1-3.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-agent@8.24.1-3.el9sat?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"product": {
"name": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"product_id": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/pulpcore-obsolete-packages@1.3.1-3.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"product": {
"name": "foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"product_id": "foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.16.0.9-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"product": {
"name": "foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"product_id": "foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer-katello@3.16.0.9-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product_id": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"product": {
"name": "python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"product_id": "python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pulp-container@2.24.12-1.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"product": {
"name": "python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"product_id": "python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pyjwt%2Bcrypto@2.13.0-1.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"product": {
"name": "python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"product_id": "python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pyjwt@2.13.0-1.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product_id": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"product": {
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"product_id": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_maintain@1.13.10-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"product": {
"name": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"product_id": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_openscap@11.1.2-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"product": {
"name": "rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"product_id": "rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.18.0.15-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-capsule-0:6.18.8-1.el9sat.noarch",
"product": {
"name": "satellite-capsule-0:6.18.8-1.el9sat.noarch",
"product_id": "satellite-capsule-0:6.18.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-capsule@6.18.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-common-0:6.18.8-1.el9sat.noarch",
"product": {
"name": "satellite-common-0:6.18.8-1.el9sat.noarch",
"product_id": "satellite-common-0:6.18.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-common@6.18.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"product": {
"name": "satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"product_id": "satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-obsolete-packages@6.18.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.18.8-1.el9sat.noarch",
"product": {
"name": "satellite-0:6.18.8-1.el9sat.noarch",
"product_id": "satellite-0:6.18.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.18.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-cli-0:6.18.8-1.el9sat.noarch",
"product": {
"name": "satellite-cli-0:6.18.8-1.el9sat.noarch",
"product_id": "satellite-cli-0:6.18.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-cli@6.18.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el9sat?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pillow@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pillow-debugsource@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pillow-debuginfo@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"product": {
"name": "python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"product_id": "python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pysequoia@0.1.33-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.15.7-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debugsource@1.15.7-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.15.7-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"product": {
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"product_id": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-agent@8.24.1-3.el9sat?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.16.0.9-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch"
},
"product_reference": "foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.16.0.9-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src"
},
"product_reference": "foreman-installer-1:3.16.0.9-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch"
},
"product_reference": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src"
},
"product_reference": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src"
},
"product_reference": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pulp-container-0:2.24.12-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch"
},
"product_reference": "python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pulp-container-0:2.24.12-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src"
},
"product_reference": "python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pyjwt-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pyjwt-0:2.13.0-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src"
},
"product_reference": "python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pysequoia-0:0.1.33-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src"
},
"product_reference": "python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64"
},
"product_reference": "python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.18.8-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src"
},
"product_reference": "satellite-0:6.18.8-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.18.8-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch"
},
"product_reference": "satellite-capsule-0:6.18.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.18.8-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.18.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch"
},
"product_reference": "satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-maintenance"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18-maintenance"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.18.8-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src"
},
"product_reference": "satellite-0:6.18.8-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.18.8-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.18.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.16.0.9-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch"
},
"product_reference": "foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.16.0.9-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src"
},
"product_reference": "foreman-installer-1:3.16.0.9-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch"
},
"product_reference": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src"
},
"product_reference": "pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src"
},
"product_reference": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pulp-container-0:2.24.12-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch"
},
"product_reference": "python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pulp-container-0:2.24.12-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src"
},
"product_reference": "python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pyjwt-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pyjwt-0:2.13.0-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src"
},
"product_reference": "python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pysequoia-0:0.1.33-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src"
},
"product_reference": "python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64"
},
"product_reference": "python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src"
},
"product_reference": "rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.18.0.15-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch"
},
"product_reference": "rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.18.0.15-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src"
},
"product_reference": "rubygem-katello-0:4.18.0.15-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.18.8-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch"
},
"product_reference": "satellite-0:6.18.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.18.8-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src"
},
"product_reference": "satellite-0:6.18.8-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.18.8-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.18.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.18.8-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.18.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch"
},
"product_reference": "satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
"product_id": "9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-9230",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2025-09-17T12:15:34.387000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2396054"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability was rated as Moderate because, while the potential impact includes an application level denial of service and possible arbitrary code execution, successful exploitation is considered unlikely due to the high attack complexity and the fact that password-based CMS encryption (PWRI) is rarely used in real-world deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9230"
},
{
"category": "external",
"summary": "RHBZ#2396054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230"
}
],
"release_date": "2025-09-30T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-12515",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-06-17T11:37:24.783000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2489812"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Katello\u0027s of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "katello: missing repository authorization in content_uploads exposes cross-product content existence",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects Katello\u0027s content upload API authorization handling. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability.\n\nKatello\u0027s content_uploads API does not properly enforce repository authorization checks when processing upload requests. A user with product-filtered edit_products permissions may query repositories outside their authorized scope and determine whether matching content exists within the Pulp content store.\n\nThe issue arises because the API allows operations against repositories that are not covered by the caller\u0027s product-scoped permissions. The response behavior may disclose whether matching content already exists, potentially revealing information about content associated with repositories that would otherwise be inaccessible to the user.\n\nBecause the impact is limited to disclosure of repository information, Red Hat assessed the Confidentiality impact as Low (C:L), with no demonstrated Integrity or Availability impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12515"
},
{
"category": "external",
"summary": "RHBZ#2489812",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489812"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12515"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12515",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12515"
},
{
"category": "external",
"summary": "https://github.com/Katello/katello/pull/11712",
"url": "https://github.com/Katello/katello/pull/11712"
}
],
"release_date": "2026-06-17T15:27:46.078000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "katello: missing repository authorization in content_uploads exposes cross-product content existence"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
},
{
"cve": "CVE-2026-54059",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-06T20:02:21.640821+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Python Pillow library. The PcfFontFile._load_bitmaps() method reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(). This allows crafted PCF font data to cause excessive memory allocation, leading to a denial of service condition. An attacker could exploit this by providing a specially crafted PCF font file to an application that uses Pillow\u0027s font loading functionality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54059"
},
{
"category": "external",
"summary": "RHBZ#2497464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"
}
],
"release_date": "2026-07-06T18:46:09.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"category": "workaround",
"details": "Do not load PCF fonts from untrusted sources. If PCF font loading is required, validate font file dimensions before passing them to Pillow, or upgrade to Pillow 12.3.0 or later which includes the fix for this vulnerability.",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted PCF font data"
},
{
"cve": "CVE-2026-54060",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-07-06T20:02:29.509113+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497466"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library\u0027s font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Pillow prior to version 12.3.0. The FontFile.compile() method in PIL/FontFile.py assembles per-glyph images into a combined bitmap using Image.new() without calling Image._decompression_bomb_check(). This allows a specially crafted font file to trigger excessive memory allocation during conversion or saving, leading to denial of service via resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54060"
},
{
"category": "external",
"summary": "RHBZ#2497466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54060"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"
}
],
"release_date": "2026-07-06T18:49:23.788000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files"
},
{
"cve": "CVE-2026-54297",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-24T17:01:10.032866+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492252"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application to build an excessively deep data structure. This can lead to a SystemStackError, resulting in a Denial of Service (DoS) by crashing the application\u0027s processing thread or worker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "faraday: Faraday: Denial of Service via crafted nested query strings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as applications utilizing the Faraday HTTP client library in Red Hat products are susceptible to a denial of service. A remote attacker can send a specially crafted nested query string, causing the Faraday::NestedParamsEncoder to create an overly deep data structure. This unbounded recursion exhausts system resources, leading to a SystemStackError and crashing the application\u0027s processing thread.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54297"
},
{
"category": "external",
"summary": "RHBZ#2492252",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492252"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54297"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54297",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54297"
},
{
"category": "external",
"summary": "https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r",
"url": "https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r"
}
],
"release_date": "2026-06-24T15:50:08.949000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "faraday: Faraday: Denial of Service via crafted nested query strings"
},
{
"cve": "CVE-2026-55379",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-06T20:01:29.922515+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497452"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library\u0027s image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55379"
},
{
"category": "external",
"summary": "RHBZ#2497452",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"
}
],
"release_date": "2026-07-06T18:52:11.633000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"category": "workaround",
"details": "Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected.",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted BDF font file"
},
{
"cve": "CVE-2026-55380",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-07-06T20:01:42.245051+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497455"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A denial-of-service vulnerability was found in Pillow\u0027s GdImageFile plugin. The GdImageFile._open() function reads image dimensions from GD 2.x file headers and stores them without performing a decompression bomb check. A crafted .gd file of approximately 1 KB can trigger an unchecked 4.3 GB C-heap allocation, potentially crashing the process or exhausting memory on systems with insufficient resources. This issue is fixed in Pillow 12.3.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55380"
},
{
"category": "external",
"summary": "RHBZ#2497455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55380"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",
"url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"
}
],
"release_date": "2026-07-06T18:50:14.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"category": "workaround",
"details": "Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file"
},
{
"cve": "CVE-2026-57236",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-06-25T15:02:37.352778+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Document#encoding= function, the library frees the document\u0027s current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a denial of service (DoS) due to a segmentation fault or information disclosure by leaking freed memory into a Ruby String.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as Nokogiri\u0027s CRuby implementation in Red Hat products is vulnerable to a use-after-free when processing invalid encoding values. A remote unauthenticated attacker can trigger a segmentation fault causing denial of service, or leak freed memory contents into a Ruby String causing information disclosure, by providing crafted input that causes an invalid encoding to be set on a document.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57236"
},
{
"category": "external",
"summary": "RHBZ#2492952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57236"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57236",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57236"
},
{
"category": "external",
"summary": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p",
"url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p"
}
],
"release_date": "2026-06-25T14:29:14.181000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:11:20+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18-capsule:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18-capsule:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18-capsule:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18-capsule:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18-capsule:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18-maintenance:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18-utils:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:foreman-installer-1:3.16.0.9-1.el9sat.src",
"9Base-satellite-6.18:foreman-installer-katello-1:3.16.0.9-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.18:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.18:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.noarch",
"9Base-satellite-6.18:pulpcore-obsolete-packages-0:1.3.1-3.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pulp-container-0:2.24.12-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.18:python3.12-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.18:python3.12-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_maintain-1:1.13.10-1.el9sat.src",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-foreman_openscap-0:11.1.2-1.el9sat.src",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.noarch",
"9Base-satellite-6.18:rubygem-katello-0:4.18.0.15-1.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.18:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-0:6.18.8-1.el9sat.src",
"9Base-satellite-6.18:satellite-cli-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-common-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.8-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.18:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling"
}
]
}
RHSA-2026:60239
Vulnerability from csaf_redhat - Published: 2026-08-26 10:22 - Updated: 2026-09-10 17:22Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60239",
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60239.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.",
"tracking": {
"current_release_date": "2026-09-10T17:22:37+00:00",
"generator": {
"date": "2026-09-10T17:22:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60239",
"initial_release_date": "2026-08-26T10:22:36+00:00",
"revision_history": [
{
"date": "2026-08-26T10:22:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T17:22:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.15",
"product": {
"name": "OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.15::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3Ad478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533565"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533565"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533565"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533565"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60246
Vulnerability from csaf_redhat - Published: 2026-08-26 10:41 - Updated: 2026-09-10 17:22Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60246",
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60246.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.",
"tracking": {
"current_release_date": "2026-09-10T17:22:38+00:00",
"generator": {
"date": "2026-09-10T17:22:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60246",
"initial_release_date": "2026-08-26T10:41:50+00:00",
"revision_history": [
{
"date": "2026-08-26T10:41:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T17:22:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.17",
"product": {
"name": "OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.17::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Aa0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124986"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124635"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124986"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Aaefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124635"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124986"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124635"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Af3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124986"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124635"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60247
Vulnerability from csaf_redhat - Published: 2026-08-26 10:45 - Updated: 2026-09-10 17:22Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60247",
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60247.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.",
"tracking": {
"current_release_date": "2026-09-10T17:22:38+00:00",
"generator": {
"date": "2026-09-10T17:22:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60247",
"initial_release_date": "2026-08-26T10:45:49+00:00",
"revision_history": [
{
"date": "2026-08-26T10:45:49+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T17:22:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.12",
"product": {
"name": "OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.12::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628706"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3Ae79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786628667"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 as a component of OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 as a component of OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60248
Vulnerability from csaf_redhat - Published: 2026-08-26 10:46 - Updated: 2026-09-10 17:22Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60248",
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60248.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.",
"tracking": {
"current_release_date": "2026-09-10T17:22:38+00:00",
"generator": {
"date": "2026-09-10T17:22:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60248",
"initial_release_date": "2026-08-26T10:46:16+00:00",
"revision_history": [
{
"date": "2026-08-26T10:46:16+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T17:22:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.14",
"product": {
"name": "OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.14::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3Ae6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3Adf06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60249
Vulnerability from csaf_redhat - Published: 2026-08-26 10:48 - Updated: 2026-09-10 17:22Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60249",
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60249.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.",
"tracking": {
"current_release_date": "2026-09-10T17:22:38+00:00",
"generator": {
"date": "2026-09-10T17:22:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60249",
"initial_release_date": "2026-08-26T10:48:04+00:00",
"revision_history": [
{
"date": "2026-08-26T10:48:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T17:22:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.13",
"product": {
"name": "OpenShift Developer Tools and Services 4.13",
"product_id": "OpenShift Developer Tools and Services 4.13",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.13::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786628681"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 as a component of OpenShift Developer Tools and Services 4.13",
"product_id": "OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.13"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 as a component of OpenShift Developer Tools and Services 4.13",
"product_id": "OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.13"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60250
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-10 17:22Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60250",
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60250.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.",
"tracking": {
"current_release_date": "2026-09-10T17:22:43+00:00",
"generator": {
"date": "2026-09-10T17:22:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60250",
"initial_release_date": "2026-08-26T10:51:30+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T17:22:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.18",
"product": {
"name": "OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.18::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Ab92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Ad455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ad31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Aff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60251
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-10 17:22Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60251",
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60251.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.",
"tracking": {
"current_release_date": "2026-09-10T17:22:39+00:00",
"generator": {
"date": "2026-09-10T17:22:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60251",
"initial_release_date": "2026-08-26T10:51:34+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T17:22:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.16",
"product": {
"name": "OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.16::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Acb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Afecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ac23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60252
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-10 17:22Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60252",
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60252.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.",
"tracking": {
"current_release_date": "2026-09-10T17:22:40+00:00",
"generator": {
"date": "2026-09-10T17:22:40+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:60252",
"initial_release_date": "2026-08-26T10:51:37+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:37+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T17:22:40+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.19",
"product": {
"name": "OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.19::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Aa0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ab952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…