In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8884 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated     jobs, such as building a software project or jobs run by cron.

    Security Fixes:

    * jenkins: Item creation restriction bypass vulnerability (CVE-2024-47804)
    * jenkins: Exposure of multi-line secrets through error messages (CVE-2024-47803)
    * jenkins: Enabling Secure Server Identity Checks for Safer SMTPS Communication (CVE-2021-44549)
    * jenkins: Denial of service when processing a specially crafted Spring Expression Language expression     (CVE-2024-38808)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments,     and other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8886 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated     jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Exposure of multi-line secrets through error messages (CVE-2024-47803)
    * jenkins: Item creation restriction bypass vulnerability (CVE-2024-47804)
    * jenkins: Enabling Secure Server Identity Checks for Safer SMTPS Communication (CVE-2021-44549)
    * jenkins: Denial of service when processing a specially crafted Spring Expression Language expression     (CVE-2024-38808)
    * jenkins-2-plugins: jenkins-plugin/script-security: sandbox bypass via crafted constructor bodies     (CVE-2024-34144)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments,     and other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8885 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated     jobs, such as building a software project or jobs run by cron.

    Security Fixes:

    * jenkins: Item creation restriction bypass vulnerability (CVE-2024-47804)
    * jenkins: Exposure of multi-line secrets through error messages     (CVE-2024-47803)
    * jenkins: Enabling Secure Server Identity Checks for Safer SMTPS Communication (CVE-2021-44549)
    * jenkins: Denial of service when processing a specially crafted Spring Expression Language expression     (CVE-2024-38808)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments,     and other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8887 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated     jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Item creation restriction bypass vulnerability (CVE-2024-47804)
    * jenkins: Exposure of multi-line secrets through error messages     (CVE-2024-47803)
    * jenkins: Enabling Secure Server Identity Checks for Safer SMTPS Communication     (CVE-2021-44549)
    * jenkins: Denial of service when processing a specially crafted Spring Expression Language expression     (CVE-2024-38808)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments,     and other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host contains a Spring Framework version prior to 5.3.39. It is, therefore, affected by a Spring expression DoS vulnerability:

  - In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a     specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
    (CVE-2024-38808)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210367	RHEL 8 : Red Hat Product OCP Tools 4.15 Openshift Jenkins (RHSA-2024:8884)	Nessus	Red Hat Local Security Checks	high
210366	RHEL 8 : Red Hat Product OCP Tools 4.12 Openshift Jenkins (RHSA-2024:8886)	Nessus	Red Hat Local Security Checks	high
210365	RHEL 8 : Red Hat Product OCP Tools 4.14 Openshift Jenkins (RHSA-2024:8885)	Nessus	Red Hat Local Security Checks	high
210364	RHEL 8 : Red Hat Product OCP Tools 4.13 Openshift Jenkins (RHSA-2024:8887)	Nessus	Red Hat Local Security Checks	high
206150	Spring Framework < 5.3.39 Spring Expression DoS (CVE-2024-38808)	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-38808

medium

Tenable Plugins

high

high

high

high

medium