Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update

Fixed packages 44

Vulnerabilities 8

• High 7.8
  CVE-2018-1000410

  Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

  An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java t…

  org.jenkins-ci.main:jenkins-core Maven
  Jan 9, 2019
• High 7.5
  CVE-2018-1999043

  Missing Release of Resource after Effective Lifetime in Jenkins

  A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using …

  org.jenkins-ci.main:jenkins-core Maven
  Aug 23, 2018
• Medium 6.5
  CVE-2018-1000406

  Path Traversal in Jenkins

  A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the …

  org.jenkins-ci.main:jenkins-core Maven
  Jan 9, 2019
• Medium 6.5
  CVE-2018-1000408

  Improper Authorization in Jenkins

  A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances us…

  org.jenkins-ci.main:jenkins-core Maven
  Jan 9, 2019
• Medium 6.5
  CVE-2018-1000997

  Improper Limitation of a Pathname to a Restricted Directory in Jenkins

  A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/s…

  org.jenkins-ci.main:jenkins-core org.kohsuke.stapler:stapler-parent Maven
  Jan 23, 2019
• Medium 6.1
  CVE-2018-1000407

  Cross-site Scripting in Jenkins

  A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenki…

  org.jenkins-ci.main:jenkins-core Maven
  Jan 9, 2019
• Medium 5.4
  CVE-2018-1000409

  Session Fixation in Jenkins

  A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a use…

  org.jenkins-ci.main:jenkins-core Maven
  Jan 9, 2019
• Unscored —
  CVE-2018-17246 Public exploit Scanner template EPSS 84%

  Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker wit…

  Elastic Kibana
  Dec 20, 2018

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1614155
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1630324
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1635804
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1639655
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1640078
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1640497
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1640746
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1642361
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1645258
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1647516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1649062
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1649997
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1650129
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhba-2018_3743.json
• report
  https://access.redhat.com/security/cve/CVE-2018-17246
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1647344
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-17246
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-17246
• article
  https://www.elastic.co/community/security
• report
  https://access.redhat.com/security/cve/CVE-2018-1000406
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1642877
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000406
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000406
• article
  https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1074
• report
  https://access.redhat.com/security/cve/CVE-2018-1000407
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1642879
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000407
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000407
• article
  https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1129
• report
  https://access.redhat.com/security/cve/CVE-2018-1000408
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1642884
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000408
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000408
• article
  https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1128
• report
  https://access.redhat.com/security/cve/CVE-2018-1000409
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1642885
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000409
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000409
• article
  https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1158