Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins-2-plugins security update

Fixed packages 1

Vulnerabilities 8

• High 8.8
  CVE-2019-10392 Public exploit EPSS 23%

  Improper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin

  Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.

  Jenkins Project Jenkins Git client Plugin org.jenkins-ci.plugins:git-client Web / CMS Maven
  Sep 12, 2019
• High 8.8
  CVE-2019-16538

  Incorrect Authorization in Jenkins Script Security Plugin

  A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Nov 21, 2019
• High 8.8
  CVE-2020-2109

  Improper Input Validation in Jenkins Pipeline: Groovy Plugin

  Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.

  Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  Feb 12, 2020
• High 8.8
  CVE-2020-2110

  Improper Input Validation in Jenkins Script Security Plugin

  Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Feb 12, 2020
• High 8.8
  CVE-2020-2134

  Sandbox bypass vulnerability in Script Security Plugin

  Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies.

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Mar 9, 2020
• High 8.8
  CVE-2020-2135

  Sandbox bypass vulnerability in Script Security Plugin

  Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Mar 9, 2020
• Medium 5.4
  CVE-2020-2111

  Subversion Plugin stored XSS vulnerability

  Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Feb 12, 2020
• Medium 5.4
  CVE-2020-2136

  Improper Neutralization of Input During Web Page Generation in Jenkins Git Plugin

  Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Git Plugin git org.jenkins-ci.plugins:git Web / CMS Azure Linux Maven
  Mar 9, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819074
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819078
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819091
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819093
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819652
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819704
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2478.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10392
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10392
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10392
• article
  https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1534
• report
  https://access.redhat.com/security/cve/CVE-2019-16538
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16538
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16538
• article
  https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658
• report
  https://access.redhat.com/security/cve/CVE-2020-2109
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2109
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2109
• article
  https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1710
• report
  https://access.redhat.com/security/cve/CVE-2020-2110
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2110
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2110
• article
  https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1713
• report
  https://access.redhat.com/security/cve/CVE-2020-2111
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2111
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2111
• article
  https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1725
• report
  https://access.redhat.com/security/cve/CVE-2020-2134
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2134
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2134
• article
  https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1754
• report
  https://access.redhat.com/security/cve/CVE-2020-2135
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2135
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2135
• report
  https://access.redhat.com/security/cve/CVE-2020-2136
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2136