Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6.35 packages update

Fixed packages 1

Vulnerabilities 4

• High 8.1
  CVE-2021-21642 EPSS 38%

  XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin

  Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Medium 6.5
  CVE-2021-21643

  Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs

  Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Medium 5.4
  CVE-2021-21644

  CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files

  A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Medium 4.3
  CVE-2021-21645

  Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs

  Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1971642
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhba-2021_2407.json
• report
  https://access.redhat.com/security/cve/CVE-2021-21642
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952146
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21642
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21642
• article
  https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2204
• report
  https://access.redhat.com/security/cve/CVE-2021-21643
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952148
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21643
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21643
• article
  https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254
• report
  https://access.redhat.com/security/cve/CVE-2021-21644
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952151
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21644
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21644
• report
  https://access.redhat.com/security/cve/CVE-2021-21645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952152
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21645
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21645