VulnerableCode Package Details - pkg:rpm/redhat/jenkins@2.414.3.1698298955-3?arch=el8

Search for packages

Vulnerability	Summary	Fixed by
VCID-432r-ukuw-4bgt Aliases: CVE-2023-27903 GHSA-584m-7r4m-8j6v	Incorrect Authorization Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.	There are no reported fixed by versions.
VCID-6925-fwf4-f7df Aliases: CVE-2023-27904 GHSA-rrgp-c2w8-6vg6	Generation of Error Message Containing Sensitive Information Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.	There are no reported fixed by versions.
VCID-h7qt-3g1f-5ffr Aliases: CVE-2023-39325 GHSA-4374-p667-p6c8	HTTP/2 rapid reset can cause excessive work in net/http A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-432r-ukuw-4bgt
Aliases:
CVE-2023-27903
GHSA-584m-7r4m-8j6v

Incorrect Authorization Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.

There are no reported fixed by versions.

VCID-6925-fwf4-f7df
Aliases:
CVE-2023-27904
GHSA-rrgp-c2w8-6vg6

Generation of Error Message Containing Sensitive Information Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.

There are no reported fixed by versions.

VCID-h7qt-3g1f-5ffr
Aliases:
CVE-2023-39325
GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T13:39:43.461639+00:00	RedHat Importer	Affected by	VCID-h7qt-3g1f-5ffr	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-39325.json	38.4.0
2026-04-01T13:55:08.071650+00:00	RedHat Importer	Affected by	VCID-6925-fwf4-f7df	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-27904.json	38.0.0
2026-04-01T13:55:07.816189+00:00	RedHat Importer	Affected by	VCID-432r-ukuw-4bgt	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-27903.json	38.0.0
2026-04-01T13:52:20.670608+00:00	RedHat Importer	Affected by	VCID-h7qt-3g1f-5ffr	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-39325.json	38.0.0