Red Hat Security Advisory: OpenShift Container Platform 4.5.7 jenkins and openshift packages security update

Fixed packages 5

Vulnerabilities 5

• High 8.0
  CVE-2020-2220

  Stored XSS vulnerability in Jenkins job build time trend

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2221

  Stored XSS vulnerability in Jenkins upstream cause

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2222

  Stored XSS vulnerability in Jenkins 'keep forever' badge icon

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2223

  Stored XSS vulnerability in Jenkins console links

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• Medium 5.5
  CVE-2020-8557

  Kubernetes node disk Denial of Service by writing to container /etc/hosts

  The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction m…

  Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go
  Jul 23, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1835977
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857425
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857427
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857433
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3519.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2220
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2220
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2220
• report
  https://access.redhat.com/security/cve/CVE-2020-2221
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2221
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2221
• report
  https://access.redhat.com/security/cve/CVE-2020-2222
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2222
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2222
• report
  https://access.redhat.com/security/cve/CVE-2020-2223
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2223
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2223
• report
  https://access.redhat.com/security/cve/CVE-2020-8557
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8557
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8557
• article
  https://groups.google.com/g/kubernetes-security-announce/c/cB_JUsYEKyY