{"id":"CVE-2023-24422","aliases":["EUVD-2023-0375","GHSA-76qj-9gwh-pvv3","RHSA-2023:1655","RHSA-2023:3195","RHSA-2023:3198","RHSA-2023:3299","RHSA-2023:3610","RHSA-2023:6171","RHSA-2023:6172","RHSA-2023:6179","RHSA-2023:7288","RHSA-2024:0775","RHSA-2024:0776","RHSA-2024:0777","RHSA-2024:0778"],"status":"published","title":"Sandbox bypass in Jenkins Script Security Plugin","description":"A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00586,"percentile":0.48306,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2023-01-24T00:00:00Z","modified":"2026-10-24T14:37:28Z","exploits":[{"source":"pocgithub","id":"shoucheng3/jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25","title":"shoucheng3/jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25","date":"2025-08-19","url":"https://github.com/shoucheng3/jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25"}],"fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","fixed_in":["1229.v4880b"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1229.v4880b"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1229.v4880b"}]}],"versions":["1.0","1.0-beta-1","1.0-beta-2","1.0-beta-3","1.0-beta-4","1.0-beta-5","1.0-beta-6","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.18.1","1.19","1.2","1.20","1.21","1.22","1.23","1.24","1.25","1.26","1.27","1.28","1.29","1.29.1","1.3","1.30","1.31","1.33","1.34","1.35","1.36","1.37","1.38","1.39","1.4","1.40","1.41","1.42","1.43","1.44","1.44.1","1.45","1.46","1.46.1","1.47","1.48","1.49","1.5","1.50","1.51","1.52","1.53","1.54","1.54.1","1.54.2","1.54.3","1.54.4","1.55","1.56","1.57","1.57.1","1.57.2","1.57.3","1.57.4","1.57.5","1.57.6","1.58","1.59","1.6","1.60","1.60.1","1.61","1.62","1.63","1.63.1","1.64","1.65","1.66","1.66.1","1.66.2","1.66.3","1.66.4","1.66.5","1.67","1.68","1.69","1.7","1.70","1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.78.1","1.8","1.9","1118.vba21ca2e3286","1125.v132f99385e1b_","1131.v8b_b_5eda_c328e","1138.v8e727069a_025","1140.vf967fb_efa_55a_","1145.1148.vf6d17a_a_a_eef6","1145.vb_cf6cf6ed960","1146.vdf547f19a_473","1158.v7c1b_73a_69a_08","1172.v35f6a_0b_8207e","1175.1177.vda_175b_77d144","1175.1179.vea_f7532629e1","1175.1180.v36a_3fb_2dec9c","1175.v4b_d517d6db_f0","1183.v774b_0b_0a_a_451","1184.v85d16b_d851b_3","1189.vb_a_b_7c8fd5fde","1190.v65867a_a_47126","1209.v50b_005db_19db","1218.v39ca_7f7ed0a_c","1228.vd93135a_2fb_25"]},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.387.1.1680701869-1.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.1680703106-1.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.19-4.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.19-4.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"haproxy22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.19-4.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"haproxy22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.19-4.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1683009955-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.387.1.1683009767-3.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.11::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.11.1683009941-1.el8"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.11::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.387.1.1683009763-3.el8"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1684911916-1.el8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.387.3.1684911776-3.el8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.401.1.1686649641-3.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1686649756-1.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.11::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.11.1698299029-1.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.11::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.414.3.1698298955-3.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1698294000-1.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.414.3.1698293911-3.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1698292274-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.414.3.1698292201-3.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.1699356715-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.414.3.1699356615-3.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.11::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.11.1706516946-1.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.11::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.426.3.1706516929-3.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1706516346-1.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.426.3.1706516254-3.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.1706516441-1.el8"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.426.3.1706516352-3.el8"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1706515741-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.426.3.1706515686-3.el8"}]}],"bundled":24}],"products":[{"vendor":"jenkins","product":"script_security"},{"vendor":"jenkins project","product":"jenkins script security plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016","tags":["x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24422","tags":["advisory"]},{"url":"https://github.com/jenkinsci/script-security-plugin/commit/4880bbe905a6783d80150c8b881d0127430d4a73","tags":["web"]},{"url":"https://github.com/advisories/GHSA-76qj-9gwh-pvv3"},{"url":"https://github.com/jenkinsci/script-security-plugin","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1655","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2162200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2162206","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177634","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1655.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3172","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3172","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3172","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/issues/112513","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31690","tags":["advisory"]},{"url":"https://spring.io/security/cve-2022-31690","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31692","tags":["advisory"]},{"url":"https://spring.io/security/cve-2022-31692","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42889","tags":["advisory"]},{"url":"https://blogs.apache.org/security/entry/cve-2022-42889","tags":["article"]},{"url":"https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om","tags":["article"]},{"url":"https://seclists.org/oss-sec/2022/q4/22","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24422","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169089","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25725","tags":["advisory"]},{"url":"https://www.haproxy.com/blog/february-2023-header-parser-fixed/","tags":["article"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg43229.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27898","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27898","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3037","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27899","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27899","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-2823","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27903","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3058","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27904","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-2120","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3195","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170041","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3195.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25761","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25761","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25762","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3019","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3198","tags":["advisory"]},{"url":"https://docs.openshift.com/container-platform/4.11/cicd/jenkins/important-changes-to-openshift-jenkins-images.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2145194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150009","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3198.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26291","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26291","tags":["advisory"]},{"url":"https://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1471","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1471","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1471","tags":["advisory"]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25857","tags":["advisory"]},{"url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/525","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29599","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29599","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30953","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30953","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30953","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30954","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30954","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30954","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43401","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43401","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43401","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43402","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43402","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43403","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43403","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43403","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43404","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43405","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43405","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43406","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43407","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43408","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43408","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43409","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45047","tags":["advisory"]},{"url":"https://www.mail-archive.com/dev@mina.apache.org/msg39312.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3299","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134292","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185707","tags":["report"]},{"url":"https://issues.redhat.com/browse/PITEAM-10","tags":["article"]},{"url":"https://issues.redhat.com/browse/PITEAM-9","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3299.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4178","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46877","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22978","tags":["advisory"]},{"url":"https://tanzu.vmware.com/security/cve-2022-22978","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080850","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25647","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40151","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40152","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3f7h-mf4q-vrm4","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24998","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","tags":["advisory"]},{"url":"https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27900","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27901","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27902","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27902","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-1807","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3610","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135770","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178358","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180530","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2188542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2207830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2207835","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3610.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40149","tags":["advisory"]},{"url":"https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40150","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45693","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45693","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1370","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1370","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-493p-pfq6-5258","tags":["advisory"]},{"url":"https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-20860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-20860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20860","tags":["advisory"]},{"url":"https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-20861","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-20861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20861","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32977","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3042","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32981","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32981","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2196","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6171","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6171.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243296","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["article","report"]},{"url":"https://go.dev/issue/63417","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6172","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6172.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6179","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6179.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7288","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7288.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0775","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222709","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260182","tags":["report"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-471","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0775.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-37946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-37946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37946","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23897","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23897","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23897","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/24/6","tags":["article"]},{"url":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23898","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23898","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0776","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JKNS-271","tags":["article"]},{"url":"https://issues.redhat.com/browse/JKNS-289","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-10934","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11158","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11329","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11446","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11452","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-1357","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13651","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13870","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14112","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14311","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14634","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15647","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15986","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-1709","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-1942","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-2099","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-2184","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-2318","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-27389","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-655","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-6579","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-6870","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-710","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8377","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8442","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPTOOLS-245","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0776.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0777","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232426","tags":["report"]},{"url":"https://issues.redhat.com/browse/JKNS-337","tags":["article"]},{"url":"https://issues.redhat.com/browse/JKNS-344","tags":["article"]},{"url":"https://issues.redhat.com/browse/JKNS-345","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11253","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11254","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13869","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14111","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14609","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15646","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15902","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-23438","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-27388","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPTOOLS-244","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0777.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-2976","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2976","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-35116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-35116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35116","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-37947","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-37947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37947","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2999","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40336","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3106","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40337","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40338","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40338","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3109","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40339","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40339","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40339","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3090","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40341","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3116","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0778","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239634","tags":["report"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-10976","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11348","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13652","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13901","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14113","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14393","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14642","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15648","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-27391","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-3692","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-4819","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-4833","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-6632","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-6982","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-7016","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-7050","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8420","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8497","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPTOOLS-246","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0778.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1962","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1962","tags":["advisory"]},{"url":"https://go.dev/issue/53616","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-20862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-20862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20862","tags":["advisory"]},{"url":"https://spring.io/security/cve-2023-20862","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-26048","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26048","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-26049","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26049","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40167","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110#section-8.6","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2023-24422","description":"A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.","status":"published","published":"2023-01-24T00:00:00Z","modified":"2025-04-02T14:30:51.711Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:27.006218Z"}],"euvd":[{"id":"EUVD-2023-0375","description":"A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.","status":"published","published":"2023-01-24T00:00:00Z","modified":"2025-04-02T14:30:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:44.834568Z"}],"ghsa":[{"id":"GHSA-76qj-9gwh-pvv3","title":"Sandbox bypass in Jenkins Script Security Plugin","description":"A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.","status":"published","published":"2023-01-26T21:30:19Z","modified":"2024-01-04T12:18:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:37:29.411214Z"}],"nvd":[{"id":"CVE-2023-24422","description":"A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.","status":"published","published":"2023-01-26T21:18:16.633Z","modified":"2026-06-17T05:39:11.777Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"CVE-2023-24422","description":"A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.","status":"published","published":"2023-01-26T21:18:16.633Z","modified":"2026-10-24T14:37:28.504902873Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"GHSA-76qj-9gwh-pvv3","title":"Sandbox bypass in Jenkins Script Security Plugin","description":"A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.","status":"published","published":"2023-01-26T21:30:19Z","modified":"2024-02-16T08:24:17.096385Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"RHSA-2023:1655","title":"Red Hat Security Advisory: OpenShift Container Platform 4.10.56 security update","status":"published","published":"2024-09-30T07:06:40Z","modified":"2026-10-02T10:02:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:3195","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T07:07:34Z","modified":"2026-10-02T10:03:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3198","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T16:32:54Z","modified":"2026-10-08T10:03:38Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3299","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T16:34:57Z","modified":"2026-10-13T10:04:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3610","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T07:07:53Z","modified":"2026-10-02T10:03:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:6171","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.11 Openshift Jenkins security update","status":"published","published":"2024-10-02T11:28:21Z","modified":"2026-10-20T10:02:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:6172","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update","status":"published","published":"2024-10-02T11:28:31Z","modified":"2026-10-20T10:02:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:6179","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update","status":"published","published":"2026-04-04T10:01:53Z","modified":"2026-10-20T10:02:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:7288","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update","status":"published","published":"2024-10-01T23:31:01Z","modified":"2026-10-20T10:02:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0775","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T16:32:23Z","modified":"2026-10-02T10:04:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0776","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T07:10:39Z","modified":"2026-10-02T10:04:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0777","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-10-02T11:39:23Z","modified":"2026-10-20T10:02:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0778","title":"Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update","status":"published","published":"2024-09-30T15:05:06Z","modified":"2026-10-13T10:06:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.270484Z"}]}}