Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.5 packages update

Fixed packages 1

Vulnerabilities 7

• High 8.6
  CVE-2020-2099

  Inbound TCP Agent Protocol/3 authentication bypass in Jenkins

  Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be u…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 5.8
  CVE-2020-2100

  Jenkins vulnerable to UDP amplification reflection attack

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 5.4
  CVE-2020-2103 Scanner template

  Jenkins Diagnostic page exposed session cookies

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 5.3
  CVE-2020-2101

  Non-constant time comparison of inbound TCP agent connection secret

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 5.3
  CVE-2020-2102

  Non-constant time HMAC comparison

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Medium 4.3
  CVE-2020-2104

  Memory usage graphs accessible to anyone with Overall/Read

  Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020
• Low 3.1
  CVE-2020-2105

  Jenkins REST APIs vulnerable to clickjacking

  REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 29, 2020

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1804814
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_0675.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2099
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797080
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2099
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2099
• report
  https://access.redhat.com/security/cve/CVE-2020-2100
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797087
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2100
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2100
• report
  https://access.redhat.com/security/cve/CVE-2020-2101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797084
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2101
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2101
• report
  https://access.redhat.com/security/cve/CVE-2020-2102
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797071
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2102
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2102
• report
  https://access.redhat.com/security/cve/CVE-2020-2103
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797062
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2103
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2103
• report
  https://access.redhat.com/security/cve/CVE-2020-2104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797065
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2104
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2104
• report
  https://access.redhat.com/security/cve/CVE-2020-2105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797068
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2105
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2105