Red Hat Security Advisory: OpenShift Container Platform 4.3.40 jenkins-2-plugins security update

Fixed packages 1

Vulnerabilities 5

• High 8.0
  CVE-2020-2224

  Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin

  Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2225

  Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin

  Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven
  Jul 15, 2020
• High 8.0
  CVE-2020-2226

  Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin

  Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.

  Jenkins Project Jenkins Matrix Authorization Strategy Plugin org.jenkins-ci.plugins:matrix-auth Web / CMS Maven
  Jul 15, 2020
• Medium 5.3
  CVE-2020-2181

  Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps

  Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

  Jenkins Project Jenkins Credentials Binding Plugin org.jenkins-ci.plugins:credentials-binding Web / CMS Maven
  May 6, 2020
• Low 3.1
  CVE-2020-2182

  Improper masking of some secrets in Jenkins Credentials Binding Plugin

  Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.

  Jenkins Project Jenkins Credentials Binding Plugin org.jenkins-ci.plugins:credentials-binding Web / CMS Maven
  May 6, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1847341
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1847348
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857439
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857441
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861842
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4265.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2181
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2181
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2181
• article
  https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374
• report
  https://access.redhat.com/security/cve/CVE-2020-2182
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2182
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2182
• article
  https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1835
• report
  https://access.redhat.com/security/cve/CVE-2020-2224
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2224
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2224
• report
  https://access.redhat.com/security/cve/CVE-2020-2225
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2225
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2225
• report
  https://access.redhat.com/security/cve/CVE-2020-2226
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2226
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2226