Loading story…
Red Hat released RHSA-2016:1773 for OpenShift Enterprise 2.2, upgrading its bundled Jenkins service to upstream LTS version 1.651.2 and remediating 14 security vulnerabilities. The update addresses critical code-execution paths including unauthenticated Jenkins Remoting/JRMP RCE (CVE-2016-0788), XML-deserialization RCE through Jenkins APIs (CVE-2016-0792), and unsafe Java deserialization in Apache Commons Collections (CVE-2015-7501); it also fixes CVE-2014-3577 in Apache HttpComponents/CXF.
Additional Jenkins fixes cover HTTP response splitting, timing weaknesses affecting API tokens and CSRF crumbs, attacker-controlled build environment variables, authentication and update-metadata denial of service, plugin and configuration disclosure, encrypted-secret exposure (CVE-2016-3724), and open redirects. The release also corrects OpenShift operational defects that prevented quota-exhausted gears from being stopped, started, or moved and left stale load-balancer routes after HA gear migrations. Organizations operating OpenShift Enterprise 2.2 should apply the advisory packages after required prior errata.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-impact advisory RHSA-2016:1773 for OpenShift Enterprise 2.2, updating it to release 2.2.10 and Jenkins to 1.651.2 LTS. The update remediated Jenkins CVEs including remote code execution, response splitting, timing, denial-of-service, disclosure, environment-variable, and redirect flaws, as well as CVE-2014-3577 and CVE-2015-7501; it also delivered related OpenShift bug fixes.
QA validated the OpenShift 2.2/2016-08-08.1 build for the regression that prevented quota-exhausted gears from being unidled, upgraded, or moved. A test application at full disk quota was successfully stopped, started, and moved after temporary quota-buffer handling was added.
Red Hat released RHSA-2016:1206, a Moderate-impact update for OpenShift Enterprise 3.2 that upgraded Jenkins to 1.651.2 LTS and fixed CVE-2016-3721 through CVE-2016-3727. The update included the openshift3/jenkins-1-rhel7:1.651.2-4 container image.
Fedora released jenkins-1.625.3-4.fc23 for Fedora 23 and jenkins-1.609.3-7.fc22 for Fedora 22, delivering fixes for the affected Jenkins issues.
Fedora published jenkins-1.651.2-1.fc24 to the Fedora 24 stable repository, incorporating fixes for the Jenkins vulnerabilities later addressed in Red Hat OpenShift advisories.
Andrej Nemec reported CVE-2016-3722 through CVE-2016-3727, covering login denial of service, plugin and configuration disclosure, encrypted-secret exposure, metadata-refresh authorization, and open redirects.
The CVE record for CVE-2016-3725 was published, documenting that authenticated Jenkins users could trigger update-site metadata refreshes without a required permission check. The capability could be combined with DNS cache poisoning to disrupt service.
Jenkins published Security Advisory 2016-02-24 covering CVE-2016-0788 through CVE-2016-0792, including remoting and remote-API code execution, HTTP response splitting, and timing weaknesses in API-token and CSRF-crumb validation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
34 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcerhn.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcewiki.jenkins-ci.org
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important security updates for **OpenShift Jenkins** in Red Hat OpenShift Developer Tools and Services 4.12 and 4.15, remediating vulnerabilities in Jenkins plugins and bundled components. The updates address arbitrary file reads, path traversal, sandbox bypass, improper input sanitization, denial-of-service conditions, SSH prefix truncation, and a Go JSON unmarshaling infinite-loop flaw across `x86_64`, `s390x`, `ppc64le`, and `aarch64` deployments. The advisories also address **CVE-2024-22201**, a Jetty HTTP/2 TLS denial-of-service vulnerability that can leak file descriptors when TCP-congested connections time out, eventually preventing affected servers from accepting legitimate connections. Red Hat provided updated Jenkins 2.440.3 packages for OpenShift 4.12 and Jenkins `2.440.3.1718879390-3.el8` with updated plugin packages for 4.15; organizations should apply the applicable OpenShift Jenkins updates.
Aug 29, 2026
Red Hat released Important-rated OpenShift Container Platform updates for versions 4.15, 4.16, 4.17, and 4.18, including 4.15.50, 4.16.33, 4.17.25, 4.18.8, and 4.18.9. The releases remediate **CVE-2025-30204**, a high-severity denial-of-service flaw in `golang-jwt/jwt` where JWT header parsing can cause excessive memory allocation from attacker-controlled tokens containing numerous period characters. Fixed upstream versions are 4.5.2 and 5.2.2. The updates also address **CVE-2024-11218**, a Podman/Buildah race condition that can enable container breakout, plus flaws in GRUB2, libxml2, Jinja2, BIND, and go-jose. Several releases fix **CVE-2025-29781**, in which the Bare Metal Operator's `BMCEventSubscription` custom resource could expose secrets across namespaces. Red Hat advises affected organizations to upgrade clusters through their applicable OpenShift release channels using the OpenShift CLI or web console across supported RHEL 8 and RHEL 9 platforms.
Aug 27, 2026
Red Hat released security updates for OpenShift Container Platform (OCP) release streams 4.13 through 4.22, including **4.19.43**, **4.20.34**, **4.21.29**, and **4.22.10**. The Important-rated updates deliver refreshed packages and container images for x86_64, s390x, ppc64le, and aarch64 deployments, including supported RHEL 8 and RHEL 9 variants. OCP 4.13.70 was rated Low, although its advisory lists fixes affecting the Linux kernel, OpenSSL, and SSSD. The fixes address vulnerabilities in the Linux kernel, Samba, SSSD, ICU, dnsmasq, OpenSSH, libarchive, rsync, Unbound, Vim, and other bundled components. Notable SSSD issues include **CVE-2026-14474**, which can enable privilege escalation through the sudo LDAP provider's directory-wide sudoRole search, and **CVE-2026-14476**, a GPO-cache path traversal flaw that can permit Kerberos authentication bypass. Red Hat advised administrators to upgrade affected clusters through their appropriate OpenShift release channels using the web console or OpenShift CLI.
Aug 25, 2026