Maven/org.jenkins-ci.plugins:oic-auth CVE-2023-50771: medium 6.1, EPSS 0.60%

Open redirect vulnerability in Jenkins OpenId Connect Authentication Plugin

Action: Upgrade org.jenkins-ci.plugins:oic-auth to 3.0 or later.

Affected

Fixed versions

Sources

• osv: GHSA-9qv8-7jfq-73j2
• https://nvd.nist.gov/vuln/detail/CVE-2023-50771
• https://github.com/jenkins-infra/update-center2/pull/767
• https://github.com/jenkinsci/oic-auth-plugin/pull/261
• https://github.com/jenkinsci/oic-auth-plugin/commit/a97a4041f39c85aa746c047ac14ee69199dadf05
• https://github.com/jenkinsci/oic-auth-plugin
• https://github.com/jenkinsci/oic-auth-plugin/releases/tag/oic-auth-3.0
• https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-2979
• http://www.openwall.com/lists/oss-security/2023/12/13/4

CVE-2023-50771 · published 2023-12-13T18:31:04Z · modified 2024-11-15T22:32:52.001589Z · JSON