Fixed packages 27
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · OpenShift 3 openshift:3.11::el7 | atomic-enterprise-service-catalog | 1:3.11.117-1.git.1.376e432.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | atomic-enterprise-service-catalog-svcat | 1:3.11.117-1.git.1.376e432.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | atomic-openshift-cluster-autoscaler | 0:3.11.117-1.git.1.caa79fa.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | atomic-openshift-descheduler | 0:3.11.117-1.git.1.1635b0a.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | atomic-openshift-dockerregistry | 0:3.11.117-1.git.1.6a42b08.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | atomic-openshift-metrics-server | 0:3.11.117-1.git.1.319d58e.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | atomic-openshift-node-problem-detector | 0:3.11.117-1.git.1.0345fe3.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | atomic-openshift-service-idler | 0:3.11.117-1.git.1.887bb82.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | atomic-openshift-web-console | 0:3.11.117-1.git.1.be7a05c.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | cri-o | 0:1.11.14-1.rhaos3.11.gitd56660e.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | cri-o-debuginfo | 0:1.11.14-1.rhaos3.11.gitd56660e.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | golang-github-openshift-oauth-proxy | 0:3.11.117-1.git.1.2b006d2.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | golang-github-prometheus-alertmanager | 0:3.11.117-1.git.1.207ef35.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | golang-github-prometheus-node_exporter | 0:3.11.117-1.git.1.dcee33f.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | golang-github-prometheus-prometheus | 0:3.11.117-1.git.1.f52d417.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | jenkins | 0:2.164.2.1555422716-1.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | jenkins-2-plugins | 0:3.11.1559667994-1.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | openshift-ansible | 0:3.11.123-1.git.0.db681ba.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | openshift-ansible-docs | 0:3.11.123-1.git.0.db681ba.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | openshift-ansible-playbooks | 0:3.11.123-1.git.0.db681ba.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | openshift-ansible-roles | 0:3.11.123-1.git.0.db681ba.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | openshift-ansible-test | 0:3.11.123-1.git.0.db681ba.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | openshift-enterprise-autoheal | 0:3.11.117-1.git.1.ef32a58.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | openshift-enterprise-cluster-capacity | 0:3.11.117-1.git.1.6593fce.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | prometheus | 0:3.11.117-1.git.1.f52d417.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | prometheus-alertmanager | 0:3.11.117-1.git.1.207ef35.el7 |
| Red Hat · OpenShift 3 openshift:3.11::el7 | prometheus-node-exporter | 0:3.11.117-1.git.1.dcee33f.el7 |
Vulnerabilities 4
-
Critical 9.9
Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin
Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
-
High 8.1
Insufficient Session Expiration in Jenkins
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases …
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jenkins
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control jo…
-
Medium 4.3
Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1418021
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1571190
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1585070
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1600741
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1608260
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1624316
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1631687
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1639427
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1640382
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1645656
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1648973
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1651564
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1652746
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1656083
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1656487
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1661076
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1667063
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1667801
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1671315
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1671837
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1676399
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1680059
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1682924
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1688250
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1688318
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1689230
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1689796
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1690066
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1691023
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1694724
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1695903
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1696249
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1698018
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1698922
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1699533
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1699696
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1700875
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1701806
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1702544