Red Hat Security Advisory: OpenShift Container Platform 4.5.6 security update

Fixed packages 3

Vulnerabilities 6

• High 8.0
  CVE-2020-2224

  Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin

  Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2225

  Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin

  Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2226

  Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin

  Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Matrix Authorization Strategy Plugin org.jenkins-ci.plugins:matrix-auth Web / CMS Maven
  Jul 15, 2020
• High 7.5
  CVE-2020-13757

  Python-RSA decryption of ciphertext leads to DoS

  Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affect…

  python-rsa rsa python-rsa Debian Ubuntu PyPI
  Jun 1, 2020
• Medium 5.3
  CVE-2020-2181

  Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps

  Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

  Jenkins Project Jenkins Credentials Binding Plugin org.jenkins-ci.plugins:credentials-binding Web / CMS Maven
  May 6, 2020
• Low 3.1
  CVE-2020-2182

  Improper masking of some secrets in Jenkins Credentials Binding Plugin

  Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.

  Jenkins Project Jenkins Credentials Binding Plugin org.jenkins-ci.plugins:credentials-binding Web / CMS Maven
  May 6, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1848507
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857439
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857441
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3453.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2181
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1847341
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2181
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2181
• article
  https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374
• report
  https://access.redhat.com/security/cve/CVE-2020-2182
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1847348
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2182
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2182
• article
  https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1835
• report
  https://access.redhat.com/security/cve/CVE-2020-2224
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2224
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2224
• report
  https://access.redhat.com/security/cve/CVE-2020-2225
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2225
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2225
• report
  https://access.redhat.com/security/cve/CVE-2020-2226
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2226
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2226
• report
  https://access.redhat.com/security/cve/CVE-2020-13757
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-13757
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-13757
• article
  https://github.com/sybrenstuvel/python-rsa/issues/146