Red Hat Security Advisory: OpenShift Container Platform 4.1.16 jenkins security update

Fixed packages 1

Vulnerabilities 2

• High 8.8
  CVE-2019-10384

  Cross-Site Request Forgery in Jenkins

  Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Aug 28, 2019
• Medium 4.8
  CVE-2019-10383

  Improper Neutralization of Input During Web Page Generation in Jenkins

  A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Aug 28, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1747293
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1747297
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2789.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10383
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10383
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10383
• article
  https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1453
• report
  https://access.redhat.com/security/cve/CVE-2019-10384
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10384
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10384
• article
  https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491