Red Hat Ocp Tools
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Ocp Tools.
Recent Red Hat Ocp Tools Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2025:16462 | (RHSA-2025:16462) Important: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update | September 23, 2025 |
| RHSA-2025:16461 | (RHSA-2025:16461) Important: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update | September 23, 2025 |
| RHSA-2025:16460 | (RHSA-2025:16460) Important: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update | September 23, 2025 |
| RHSA-2025:16459 | (RHSA-2025:16459) Important: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update | September 23, 2025 |
| RHSA-2025:16457 | (RHSA-2025:16457) Important: Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update | September 23, 2025 |
| RHSA-2025:16456 | (RHSA-2025:16456) Important: Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update | September 23, 2025 |
| RHSA-2025:16455 | (RHSA-2025:16455) Important: Red Hat Product OCP Tools 4.18 Openshift Jenkins security update | September 23, 2025 |
| RHSA-2025:16454 | (RHSA-2025:16454) Important: Red Hat Product OCP Tools 4.19 OpenShift Jenkins security update | September 23, 2025 |
| RHSA-2025:15817 | (RHSA-2025:15817) Important: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update | September 15, 2025 |
| RHSA-2025:15816 | (RHSA-2025:15816) Important: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update | September 15, 2025 |
By the Year
In 2026 there have been 0 vulnerabilities in Red Hat Ocp Tools. Last year, in 2025 Ocp Tools had 1 security vulnerability published. Right now, Ocp Tools is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 1 | 6.50 |
| 2024 | 6 | 7.43 |
It may take a day or so for new Ocp Tools vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Ocp Tools Security Vulnerabilities
Token Exposure via Unobfuscated Bearer Token in OpenShift Jenkins Logs
CVE-2024-9453
6.5 - Medium
- July 04, 2025
A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.
Insertion of Sensitive Information into Log File
Symlink Traversal via containers/storage leads Podman/CRIO OOM CVE20249676
CVE-2024-9676
6.5 - Medium
- October 15, 2024
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
Directory traversal
Buildah Cache Mount Path Traversal via RUN Instruction
CVE-2024-9675
7.8 - High
- October 09, 2024
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
Directory traversal
Uninitialized Buffer in Go FIPS OpenSSL May Cause False HMAC Match
CVE-2024-9355
6.5 - Medium
- October 01, 2024
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Use of Uninitialized Variable
Authenticated Registry Access Path Traversal in containers/image
CVE-2024-3727
8.3 - High
- May 14, 2024
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
Improper Validation of Integrity Check Value
Memory Leak in Go RSA (golang-fips/openssl) Leads to Resource Exhaustion
CVE-2024-1394
7.5 - High
- March 21, 2024
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
Memory Leak
Unauth RCE via Unsafe Decompression in devfile registry-support
CVE-2024-1485
8 - High
- February 14, 2024
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Relative Path Traversal
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Ocp Tools or by Red Hat? Click the Watch button to subscribe.
