Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update

Fixed packages 45

Vulnerabilities 8

• High 8.6
  CVE-2020-2099

  Inbound TCP Agent Protocol/3 authentication bypass in Jenkins

  Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be u…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 6.1
  CVE-2019-11358 Public exploit EPSS 87%

  XSS in jQuery as used in Drupal, Backdrop CMS, and other products

  jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

  mediawiki mediawiki django drupal/core Debian Ubuntu Azure Linux Alpine npm Packagist Maven PyPI NuGet RubyGems
  Apr 19, 2019
• Medium 5.8
  CVE-2020-2100

  Jenkins vulnerable to UDP amplification reflection attack

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 5.4
  CVE-2020-2103 Scanner template

  Jenkins Diagnostic page exposed session cookies

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 5.3
  CVE-2020-2101

  Non-constant time comparison of inbound TCP agent connection secret

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 5.3
  CVE-2020-2102

  Non-constant time HMAC comparison

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 4.3
  CVE-2020-2104

  Memory usage graphs accessible to anyone with Overall/Read

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Low 3.1
  CVE-2020-2105

  Jenkins REST APIs vulnerable to clickjacking

  REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1670380
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1670587
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1728856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1744900
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1749765
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1757314
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1757938
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1782695
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1783764
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1791667
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1793628
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1795930
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1798365
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_0402.json
• report
  https://access.redhat.com/security/cve/CVE-2019-11358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701972
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11358
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11358
• article
  https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
• article
  https://www.drupal.org/sa-core-2019-006
• report
  https://access.redhat.com/security/cve/CVE-2020-2099
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797080
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2099
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2099
• report
  https://access.redhat.com/security/cve/CVE-2020-2100
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797087
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2100
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2100
• report
  https://access.redhat.com/security/cve/CVE-2020-2101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797084
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2101
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2101
• report
  https://access.redhat.com/security/cve/CVE-2020-2102
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797071
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2102
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2102
• report
  https://access.redhat.com/security/cve/CVE-2020-2103
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797062
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2103