This advisory covers several security fixes for Jenkins and its plugins within Red Hat Product OCP Tools 4.17. The fixed vulnerabilities include CVE-2024-47072, a denial of service in XStream caused by stack overflow from manipulated binary input; CVE-2024-47855, mishandling of unbalanced comment strings in json-lib; CVE-2024-52549, a file disclosure vulnerability in the Jenkins Script Security Plugin; CVE-2024-52550, lack of approval checks for rebuilt Jenkins pipelines; and CVE-2024-52551, allowing restart of builds with unapproved Jenkinsfiles in the Pipeline Declarative Plugin. These vulnerabilities affect Jenkins versions packaged with OpenShift Developer Tools and Services 4.17 across multiple architectures. Red Hat has issued updated packages to remediate these issues.

The vulnerabilities collectively could allow unauthorized actions such as restarting Jenkins builds with unapproved Jenkinsfiles, disclosure of sensitive files via the Script Security Plugin, denial of service through stack overflow in XStream, and improper handling of pipeline rebuild approvals. These issues may disrupt continuous integration workflows, potentially exposing sensitive information or causing service interruptions. The advisory rates the security impact as important/high severity but does not report any known exploits in the wild at this time.

Red Hat has released updated packages for OpenShift Developer Tools and Services 4.17 that address these vulnerabilities. Users should apply these security updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Before updating, it is recommended to back up existing installations, including applications, configurations, and databases. No additional mitigations are specified beyond applying the official patches.