CVE-2023-38039, CVE-2023-38408, CVE-2023-38039, CVE-2023-38039, CVE-2023-44487 about docker HOT 4 CLOSED

I'm closing this issue as per: https://www.jenkins.io/security/reporting. You need to follow carefully these instruction to responsibly report any vulnerability.

from docker.

Please, see #1740 (comment) for the curl CVEs. The reports provided here looks really wrong:

$ docker run --rm --entrypoint='' jenkins/jenkins:2.414.3-jdk11 sh -c 'dpkg -l | grep -w curl'
ii  curl                      7.88.1-10+deb12u4              arm64        command line tool for transferring data with URL syntax

from docker.

Same, the OpenSSH report looks suspicious:

$ docker run --rm --entrypoint='' jenkins/jenkins:2.414.3-jdk11 sh -c 'dpkg -l | grep -w openssh-client'
ii  openssh-client            1:9.2p1-2+deb12u1              arm64        secure shell (SSH) client, for secure access to remote machines

Like the curl package, the image you mentioned ( jenkins/jenkins:2.414.3-jdk11) have the fixed packages, making the request not realistic.

You should check what your "wiz" (No idea what it is) tool is doing and checking but it looks like it's sending you false positives.

from docker.

As for CVE-2023-44487, please check https://www.jenkins.io/security/advisory/2023-10-18/ which delivered the Jetty server with the patch for Jenkins.

There is a libnghttp2 (shared) library in the images but I can't find any proof of exploit due to this library. As per https://security-tracker.debian.org/tracker/CVE-2023-44487, there are NO fix for nghttp2 webserver but it is not installed.

from docker.