Skip to content
OpenAdvisories
High RHBA-2017:2642 4 CVEs

Red Hat Bug Fix Advisory: OpenShift Container Platform 3.6.1 bug fix and enhancement update

Published Sep 16, 2024 · Updated May 13, 2026

Ecosystem: Red Hat

Fixed packages 35

ReleasePackageFixed in
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-clients 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-clients-redistributable 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-cluster-capacity 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-docker-excluder 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-dockerregistry 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-excluder 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-federation-services 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-master 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-node 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-pod 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-sdn-ovs 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-service-catalog 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 atomic-openshift-tests 0:3.6.173.0.21-1.git.0.f95b0e7.el7
Red Hat · OpenShift 3 openshift:3.6::el7 fluentd 0:0.12.39-2.el7
Red Hat · OpenShift 3 openshift:3.6::el7 fluentd-doc 0:0.12.39-2.el7
Red Hat · OpenShift 3 openshift:3.6::el7 jenkins-2-plugins 0:3.7.1502412812-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 kibana 0:4.6.4-3.el7
Red Hat · OpenShift 3 openshift:3.6::el7 kibana-debuginfo 0:4.6.4-3.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-cool.io 0:1.5.1-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-cool.io-debuginfo 0:1.5.1-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-cool.io-doc 0:1.5.1-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-excon 0:0.58.0-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-excon-doc 0:0.58.0-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-faraday 0:0.13.0-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-faraday-doc 0:0.13.0-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-fluent-plugin-kubernetes_metadata_filter 0:0.29.0-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-fluent-plugin-kubernetes_metadata_filter-doc 0:0.29.0-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-fluent-plugin-viaq_data_model 0:0.0.5-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-fluent-plugin-viaq_data_model-doc 0:0.0.5-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-i18n 0:0.8.6-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-i18n-doc 0:0.8.6-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-systemd-journal 0:1.3.0-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 rubygem-systemd-journal-doc 0:1.3.0-1.el7
Red Hat · OpenShift 3 openshift:3.6::el7 tuned-profiles-atomic-openshift-node 0:3.6.173.0.21-1.git.0.f95b0e7.el7

Vulnerabilities 4

  • High 8.8
    CVE-2017-1000096

    Arbitrary code execution due to incomplete sandbox protection in Jenkins Pipeline

    Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploi…

    org.jenkins-ci.plugins.workflow:workflow-cps Maven
  • High 7.5
    CVE-2017-1000092

    Cross-Site Request Forgery in Jenkins Git Plugin

    Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a…

    org.jenkins-ci.plugins:git Maven
  • Medium 6.5
    CVE-2017-1000085

    Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability

    Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to conn…

    subversion org.jenkins-ci.plugins:subversion Azure Linux Maven
  • Medium 5.3
    CVE-2017-1000089

    Jenkins Build Step Plugin fails to check Item/Build permission

    Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggerin…

    org.jenkins-ci.plugins:pipeline-build-step Maven

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1420976
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1423640
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1473736
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1476731
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1477223
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1477933
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1479130
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1479928
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1481251
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1482273
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1484958
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhba-2017_2642.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-1000085
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1471046
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-1000085
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-1000085
  • article
    https://jenkins.io/security/advisory/2017-07-10/
  • report
    https://access.redhat.com/security/cve/CVE-2017-1000089
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1471050
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-1000089
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-1000089
  • report
    https://access.redhat.com/security/cve/CVE-2017-1000092
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1471053
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-1000092
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-1000092
  • report
    https://access.redhat.com/security/cve/CVE-2017-1000096
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1471064
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-1000096
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-1000096