Red Hat Bug Fix Advisory: OpenShift Container Platform 4.9.52 packages update

Fixed packages 1

Vulnerabilities 2

• High 8.0
  CVE-2022-34176 EPSS 78%

  Cross-site Scripting in Jenkins JUnit Plugin

  Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.

  Jenkins Project Jenkins JUnit Plugin org.jenkins-ci.plugins:junit Web / CMS Maven
  Jun 22, 2022
• Medium 4.8
  CVE-2022-36881

  Jenkins Git client plugin 3.11.0 does not perform SSH host key verification

  Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.

  Jenkins Project Jenkins Git client Plugin org.jenkins-ci.plugins:git-client Web / CMS Maven
  Jul 27, 2022

References

• article
  https://issues.redhat.com/browse/OCPBUGS-3983
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_8582.json
• report
  https://access.redhat.com/security/cve/CVE-2022-34176
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2103548
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-34176
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-34176
• article
  https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760
• report
  https://access.redhat.com/security/cve/CVE-2022-36881
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2114755
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-36881
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-36881
• advisory
  https://github.com/advisories/GHSA-cm7j-p8hc-97vj
• article
  https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468