Red Hat Bug Fix Advisory: OpenShift Container Platform 4.7.24 packages update

Fixed packages 1

Vulnerabilities 2

• High 7.5
  CVE-2021-21671

  Session fixation vulnerability in Jenkins

  Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jun 30, 2021
• Medium 4.3
  CVE-2021-21670

  Improper permission checks allow canceling queue items and aborting builds in Jenkins

  Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jun 30, 2021

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1991349
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhba-2021_3033.json
• report
  https://access.redhat.com/security/cve/CVE-2021-21670
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2007749
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21670
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21670
• article
  https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2278
• report
  https://access.redhat.com/security/cve/CVE-2021-21671
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2007750
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21671
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21671
• article
  https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2371