Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3 RPM release advisory

Fixed packages 5

Vulnerabilities 7

• Medium 5.9
  CVE-2019-11840

  golang.org/x/crypto/salsa20/salsa uses insufficiently random values

  An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa package…

  k3d k3d-proxy k3d-tools snapd Debian Ubuntu Wolfi Go
  May 9, 2019
• Medium 5.4
  CVE-2019-10401

  Improper Neutralization of Input During Web Page Generation in Jenkins

  In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Confi…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Sep 25, 2019
• Medium 5.4
  CVE-2019-10402

  Improper Neutralization of Input During Web Page Generation in Jenkins

  In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Sep 25, 2019
• Medium 5.4
  CVE-2019-10403

  Improper Neutralization of Input During Web Page Generation in Jenkins

  Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Sep 25, 2019
• Medium 5.4
  CVE-2019-10404

  Improper Neutralization of Input During Web Page Generation in Jenkins

  Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expr…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Sep 25, 2019
• Medium 4.8
  CVE-2019-10406

  Improper Neutralization of Input During Web Page Generation in Jenkins

  Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Sep 25, 2019
• Medium 4.3
  CVE-2019-10405 Scanner template EPSS 65%

  Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

  Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Sep 25, 2019

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1773099
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_0063.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10401
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1764357
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10401
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10401
• report
  https://access.redhat.com/security/cve/CVE-2019-10402
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1764363
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10402
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10402
• report
  https://access.redhat.com/security/cve/CVE-2019-10403
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1764366
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10403
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10403
• report
  https://access.redhat.com/security/cve/CVE-2019-10404
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1764367
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10404
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10404
• report
  https://access.redhat.com/security/cve/CVE-2019-10405
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1764369
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10405
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10405
• report
  https://access.redhat.com/security/cve/CVE-2019-10406
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1764370
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10406
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10406
• report
  https://access.redhat.com/security/cve/CVE-2019-11840
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1691529
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11840
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11840
• article
  https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ