Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. OpenShift Login Plugin 1.1.0.230.v5d7030bf5432 invalidates the existing session on login.
Recommended action: Upgrade to 1.1.0.230.v5d7030b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. OpenShift Login Plugin 1.1.0.230.v5d7030bf5432 only redirects to relative (Jenkins) URLs.
Recommended action: Upgrade to 1.1.0.230.v5d7030b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.