Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.18 packages update

Fixed packages 1

Vulnerabilities 4

• High 8.0
  CVE-2020-2220

  Stored XSS vulnerability in Jenkins job build time trend

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2221

  Stored XSS vulnerability in Jenkins upstream cause

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2222

  Stored XSS vulnerability in Jenkins 'keep forever' badge icon

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2223

  Stored XSS vulnerability in Jenkins console links

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1868361
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_3441.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2220
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857425
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2220
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2220
• report
  https://access.redhat.com/security/cve/CVE-2020-2221
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857427
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2221
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2221
• report
  https://access.redhat.com/security/cve/CVE-2020-2222
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857431
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2222
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2222
• report
  https://access.redhat.com/security/cve/CVE-2020-2223
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857433
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2223
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2223