Bug 2222710 (CVE-2023-37947)

Summary: CVE-2023-37947 Jenkins: Open redirect vulnerability in OpenShift Login Plugin
Product: [Other] Security Response Reporter: Zack Miele <zmiele>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abenaiss, dfreiber, ellin, jburrell, rogbas, scorneli, shbose, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to conduct phishing attacks caused by an open redirect vulnerability. An attacker can use a specially crafted URL to redirect a victim to arbitrary web sites.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2222712    

Description Zack Miele 2023-07-13 14:28:08 UTC 
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
https://www.jenkins.io/security/advisory/2023-07-12/

SECURITY-2999 / CVE-2023-37947
OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly
determines that a redirect URL after login is legitimately pointing to
Jenkins.

This allows attackers to perform phishing attacks by having users go to a
Jenkins URL that will forward them to a different site after successful
authentication.
Comment 3 errata-xmlrpc 2024-02-12 10:25:31 UTC 
This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.14

Via RHSA-2024:0777 https://access.redhat.com/errata/RHSA-2024:0777
Comment 4 errata-xmlrpc 2024-02-12 10:37:02 UTC 
This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.12

Via RHSA-2024:0778 https://access.redhat.com/errata/RHSA-2024:0778