cve-2024-23897
CRITICAL CVSS 9.8 csaf_redhat
Description
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Timeline
- Published
- 2024-01-09 00:00 UTC
- Last Modified
- 2025-11-21
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
No references available.
Linked Vulnerabilities
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright © Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-23897.json"
}
],
"title": "jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE",
"tracking": {
"current_release_date": "2025-11-21T14:38:44+00:00",
"generator": {
"date": "2025-11-21T14:38:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "CVE-2024-23897",
"initial_release_date": "2024-01-09T00:00:00+00:00",
"revision_history": [
{
"date": "2024-01-09T00:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-08-19T17:43:30+00:00",
"number": "2",
"summary": "Current version"
},
{
"date": "2025-11-21T14:38:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 3.11",
"product": {
"name": "Red Hat OpenShift Container Platform 3.11",
"product_id": "red_hat_openshift_container_platform_3.11",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:3.11"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Container Platform 3.11"
},
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services for OCP 4.12",
"product": {
"name": "OpenShift Developer Tools and Services for OCP 4.12",
"product_id": "8Base-OCP-Tools-4.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.12::el8"
}
}
},
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services for OCP 4.13",
"product": {
"name": "OpenShift Developer Tools and Services for OCP 4.13",
"product_id": "8Base-OCP-Tools-4.13",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.13::el8"
}
}
},
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8",
"product": {
"name": "OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8",
"product_id": "8Base-OCP-Tools-4.11",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.11::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Jenkins"
},
{
"category": "product_version",
"name": "jenkins.src",
"product": {
"name": "jenkins.src",
"product_id": "jenkins.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins?arch=src"
}
}
},
{
"category": "product_version",
"name": "jenkins",
"product": {
"name": "jenkins",
"product_id": "jenkins",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins"
}
}
},
{
"branches": [
{
"category": "product_version",
"name": "jenkins-0:2.426.3.1706515686-3.el8.src",
"product": {
"name": "jenkins-0:2.426.3.1706515686-3.el8.src",
"product_id": "jenkins-0:2.426.3.1706515686-3.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins@2.426.3.1706515686-3.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "jenkins-2-plugins-0:4.12.1706515741-1.el8.src",
"product": {
"name": "jenkins-2-plugins-0:4.12.1706515741-1.el8.src",
"product_id": "jenkins-2-plugins-0:4.12.1706515741-1.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins-2-plugins@4.12.1706515741-1.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "jenkins-0:2.426.3.1706516254-3.el8.src",
"product": {
"name": "jenkins-0:2.426.3.1706516254-3.el8.src",
"product_id": "jenkins-0:2.426.3.1706516254-3.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins@2.426.3.1706516254-3.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "jenkins-2-plugins-0:4.13.1706516346-1.el8.src",
"product": {
"name": "jenkins-2-plugins-0:4.13.1706516346-1.el8.src",
"product_id": "jenkins-2-plugins-0:4.13.1706516346-1.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins-2-plugins@4.13.1706516346-1.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "jenkins-0:2.426.3.1706516929-3.el8.src",
"product": {
"name": "jenkins-0:2.426.3.1706516929-3.el8.src",
"product_id": "jenkins-0:2.426.3.1706516929-3.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins@2.426.3.1706516929-3.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "jenkins-2-plugins-0:4.11.1706516946-1.el8.src",
"product": {
"name": "jenkins-2-plugins-0:4.11.1706516946-1.el8.src",
"product_id": "jenkins-2-plugins-0:4.11.1706516946-1.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins-2-plugins@4.11.1706516946-1.el8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jenkins-0:2.426.3.1706515686-3.el8.noarch",
"product": {
"name": "jenkins-0:2.426.3.1706515686-3.el8.noarch",
"product_id": "jenkins-0:2.426.3.1706515686-3.el8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins@2.426.3.1706515686-3.el8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch",
"product": {
"name": "jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch",
"product_id": "jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins-2-plugins@4.12.1706515741-1.el8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jenkins-0:2.426.3.1706516254-3.el8.noarch",
"product": {
"name": "jenkins-0:2.426.3.1706516254-3.el8.noarch",
"product_id": "jenkins-0:2.426.3.1706516254-3.el8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins@2.426.3.1706516254-3.el8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch",
"product": {
"name": "jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch",
"product_id": "jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins-2-plugins@4.13.1706516346-1.el8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jenkins-0:2.426.3.1706516929-3.el8.noarch",
"product": {
"name": "jenkins-0:2.426.3.1706516929-3.el8.noarch",
"product_id": "jenkins-0:2.426.3.1706516929-3.el8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins@2.426.3.1706516929-3.el8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch",
"product": {
"name": "jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch",
"product_id": "jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins-2-plugins@4.11.1706516946-1.el8?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-0:2.426.3.1706516929-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8",
"product_id": "8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.noarch"
},
"product_reference": "jenkins-0:2.426.3.1706516929-3.el8.noarch",
"relates_to_product_reference": "8Base-OCP-Tools-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-0:2.426.3.1706516929-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8",
"product_id": "8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.src"
},
"product_reference": "jenkins-0:2.426.3.1706516929-3.el8.src",
"relates_to_product_reference": "8Base-OCP-Tools-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8",
"product_id": "8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch"
},
"product_reference": "jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch",
"relates_to_product_reference": "8Base-OCP-Tools-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-2-plugins-0:4.11.1706516946-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8",
"product_id": "8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.src"
},
"product_reference": "jenkins-2-plugins-0:4.11.1706516946-1.el8.src",
"relates_to_product_reference": "8Base-OCP-Tools-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-0:2.426.3.1706515686-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12",
"product_id": "8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.noarch"
},
"product_reference": "jenkins-0:2.426.3.1706515686-3.el8.noarch",
"relates_to_product_reference": "8Base-OCP-Tools-4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-0:2.426.3.1706515686-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12",
"product_id": "8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.src"
},
"product_reference": "jenkins-0:2.426.3.1706515686-3.el8.src",
"relates_to_product_reference": "8Base-OCP-Tools-4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12",
"product_id": "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch"
},
"product_reference": "jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch",
"relates_to_product_reference": "8Base-OCP-Tools-4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-2-plugins-0:4.12.1706515741-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12",
"product_id": "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.src"
},
"product_reference": "jenkins-2-plugins-0:4.12.1706515741-1.el8.src",
"relates_to_product_reference": "8Base-OCP-Tools-4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-0:2.426.3.1706516254-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.13",
"product_id": "8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.noarch"
},
"product_reference": "jenkins-0:2.426.3.1706516254-3.el8.noarch",
"relates_to_product_reference": "8Base-OCP-Tools-4.13"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-0:2.426.3.1706516254-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.13",
"product_id": "8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.src"
},
"product_reference": "jenkins-0:2.426.3.1706516254-3.el8.src",
"relates_to_product_reference": "8Base-OCP-Tools-4.13"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.13",
"product_id": "8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch"
},
"product_reference": "jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch",
"relates_to_product_reference": "8Base-OCP-Tools-4.13"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-2-plugins-0:4.13.1706516346-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.13",
"product_id": "8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.src"
},
"product_reference": "jenkins-2-plugins-0:4.13.1706516346-1.el8.src",
"relates_to_product_reference": "8Base-OCP-Tools-4.13"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "red_hat_openshift_container_platform_3.11:jenkins"
},
"product_reference": "jenkins",
"relates_to_product_reference": "red_hat_openshift_container_platform_3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins.src as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "red_hat_openshift_container_platform_3.11:jenkins.src"
},
"product_reference": "jenkins.src",
"relates_to_product_reference": "red_hat_openshift_container_platform_3.11"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-23897",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"
},
"discovery_date": "2024-01-24T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.src",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.src",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2260180"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins, which uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces the \"@\" character followed by a file path in an argument with the file’s contents (expandAtFiles). This feature is enabled by default; Jenkins 2.441 and earlier as well as LTS 2.426.2 and earlier do not disable it.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.src",
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.src",
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.src"
],
"known_affected": [
"red_hat_openshift_container_platform_3.11:jenkins",
"red_hat_openshift_container_platform_3.11:jenkins.src"
],
"known_not_affected": [
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.src",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.src",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-23897"
},
{
"category": "external",
"summary": "RHBZ#2260180",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260180"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-23897",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23897"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-23897",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23897"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2024/01/24/6",
"url": "http://www.openwall.com/lists/oss-security/2024/01/24/6"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314",
"url": "https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2024-01-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-02-12T10:46:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.src"
],
"url": "https://access.redhat.com/errata/RHSA-2024:0775"
},
{
"category": "vendor_fix",
"date": "2024-02-12T10:38:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.src"
],
"url": "https://access.redhat.com/errata/RHSA-2024:0778"
},
{
"category": "vendor_fix",
"date": "2024-02-12T10:26:48+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.src"
],
"url": "https://access.redhat.com/errata/RHSA-2024:0776"
},
{
"category": "workaround",
"details": "Disabling access to the CLI is expected to prevent exploitation completely. Doing so is strongly recommended to administrators unable to immediately update to Jenkins 2.442, LTS 2.426.3 or LTS 2.440.1. Applying this workaround does not require a Jenkins restart.",
"product_ids": [
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.src",
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.src",
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.src",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.src",
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.src",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.src",
"red_hat_openshift_container_platform_3.11:jenkins",
"red_hat_openshift_container_platform_3.11:jenkins.src"
]
},
{
"category": "no_fix_planned",
"details": "Out of support scope",
"product_ids": [
"red_hat_openshift_container_platform_3.11:jenkins",
"red_hat_openshift_container_platform_3.11:jenkins.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.src",
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.src",
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.src",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.src",
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.src",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.src",
"red_hat_openshift_container_platform_3.11:jenkins",
"red_hat_openshift_container_platform_3.11:jenkins.src"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2024-08-19T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Critical",
"product_ids": [
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-0:2.426.3.1706516929-3.el8.src",
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch",
"8Base-OCP-Tools-4.11:jenkins-2-plugins-0:4.11.1706516946-1.el8.src",
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-0:2.426.3.1706515686-3.el8.src",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.noarch",
"8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1706515741-1.el8.src",
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-0:2.426.3.1706516254-3.el8.src",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch",
"8Base-OCP-Tools-4.13:jenkins-2-plugins-0:4.13.1706516346-1.el8.src",
"red_hat_openshift_container_platform_3.11:jenkins",
"red_hat_openshift_container_platform_3.11:jenkins.src"
]
}
],
"title": "jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE"
}
]
}