Red Hat Security Advisory: OpenShift Container Platform 3.11 security update

Fixed packages 9

Vulnerabilities 10

• High 8.0
  CVE-2020-2220

  Stored XSS vulnerability in Jenkins job build time trend

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2221

  Stored XSS vulnerability in Jenkins upstream cause

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2222

  Stored XSS vulnerability in Jenkins 'keep forever' badge icon

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2223

  Stored XSS vulnerability in Jenkins console links

  Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2224

  Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin

  Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2225

  Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin

  Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2226

  Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin

  Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Matrix Authorization Strategy Plugin org.jenkins-ci.plugins:matrix-auth Web / CMS Maven
  Jul 15, 2020
• High 7.5
  CVE-2020-13757

  Python-RSA decryption of ciphertext leads to DoS

  Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affect…

  rsa python-rsa python-rsa Debian Ubuntu PyPI
  Jun 1, 2020
• Medium 6.5
  CVE-2019-16541

  Jenkins JIRA Plugin allows users to select and use credentials with System scope

  Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

  Jenkins Project Jenkins JIRA Plugin org.jenkins-ci.plugins:jira Web / CMS Maven
  Nov 21, 2019
• Medium 5.9
  CVE-2020-1741

  A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specifie…

  Red Hat openshift-ansible
  Apr 24, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1802381
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819663
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1848507
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857425
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857427
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857433
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857439
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857441
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3541.json
• report
  https://access.redhat.com/security/cve/CVE-2019-16541
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16541
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16541
• article
  https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1106
• report
  https://access.redhat.com/security/cve/CVE-2020-1741
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-1741
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-1741
• report
  https://access.redhat.com/security/cve/CVE-2020-2220
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2220
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2220
• report
  https://access.redhat.com/security/cve/CVE-2020-2221
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2221
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2221
• report
  https://access.redhat.com/security/cve/CVE-2020-2222
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2222
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2222
• report
  https://access.redhat.com/security/cve/CVE-2020-2223
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2223
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2223
• report
  https://access.redhat.com/security/cve/CVE-2020-2224
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2224
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2224
• report
  https://access.redhat.com/security/cve/CVE-2020-2225
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2225
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2225
• report
  https://access.redhat.com/security/cve/CVE-2020-2226
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2226