https://bugzilla.redhat.com/show_bug.cgi?id=1620337
--- Comment #4 from Jason Shepherd <jshepherd(a)redhat.com> ---
The communication between Jenkins master and slave happens using the encrypted
Jenkins Remoting JNLP4 protocol, [1]. Also the master exposes the JNLP port as
a service, not a route. So it should not be accessible outside of the project
unless the ovs-subnet plugin is in use.
Because of these reasons the impact of the flaw itself if 'Low', Product
Security have decided not to fix this issue in OCP 3.10 and earlier. Upgrade to
OCP 3.11 to obtain a fix for this issue.
[1]
https://github.com/jenkinsci/remoting/blob/master/docs/protocols.md#jnlp4...
--
You are receiving this mail because:
You are on the CC list for the bug.