Jenkins Blue Ocean plugin before version 1.10.2 did not properly escape HTML/JavaScript content set on the current user’s description field, resulting in a cross-site scripting vulnerability exploitable by administrators and other people accessing Jenkins with the same user account. Blue Ocean now properly escapes HTML/JavaScript content set on the current user’s description field. External Reference: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204 Upstream patches: https://github.com/jenkinsci/blueocean-plugin/commit/62775e78532b756826bb237775b64a5052624b57
openshift-enterprise 3.4-3.11 inclusive: affected Once openshift3/jenkins-1-rhel7, openshift3/jenkins-2-rhel7, openshift3/jenkins-slave-base-rhel7 container images have been released with these fixes, users of all versions of openshift-enterprise-3.2+ are encouraged to update these container images in their environment.