Veille CVE

Recherche « Red Hat OpenShift Developer Tools and Services »

6 CVE

Critique 0 Élevée 4 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenShift Developer Tools and Services » ✕
  1. CVE-2026-57281 7.5 Élevée

    Jenkins Project Jenkins Script Security Plugin · Red Hat OpenShift Developer Tools and Services 4.12 · Red Hat OpenShift Developer Tools and Services 4.13 · Red Hat OpenShift Developer Tools and Services 4.14

    Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

  2. CVE-2026-53437 4.3 Moyenne

    Jenkins Project Jenkins · Red Hat OpenShift Developer Tools and Services 4.12 · Red Hat OpenShift Developer Tools and Services 4.13 · Red Hat OpenShift Developer Tools and Services 4.14

    Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

  3. CVE-2026-53435 8.8 Élevée

    Jenkins Project Jenkins · Red Hat OpenShift Developer Tools and Services 4.12 · Red Hat OpenShift Developer Tools and Services 4.13 · Red Hat OpenShift Developer Tools and Services 4.14

    In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

  4. CVE-2026-41567 7.2 Élevée

    moby/v2/daemon · moby Docker Engine · docker/daemon · Red Hat Multicluster Global Hub 1.4.5

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

  5. CVE-2024-9355 6.5 Moyenne

    Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

    A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

  6. CVE-2024-3727 8.3 Élevée

    Red Hat OADP-1.3-RHEL-9 · Red Hat Advanced Cluster Security 4.4 · Red Hat Advanced Cluster Security 4.5 · Red Hat Enterprise Linux 8

    A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.