Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update

Fixed packages 22

Vulnerabilities 9

• High 7.5
  CVE-2020-14040

  golang.org/x/text Infinite loop

  The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder insta…

  k3d k3d-proxy k3d-tools podman Debian Ubuntu Azure Linux Wolfi Go
  Jun 17, 2020
• Medium 6.5
  CVE-2019-16541

  Jenkins JIRA Plugin allows users to select and use credentials with System scope

  Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

  Jenkins Project Jenkins JIRA Plugin org.jenkins-ci.plugins:jira Web / CMS Maven
  Nov 21, 2019
• Medium 5.3
  CVE-2020-14370

  Information disclosure in podman

  An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from th…

  podman github.com/containers/podman/v2 libpod github.com/containers/libpod Debian Alpine Go
  Sep 23, 2020
• Medium 5.3
  CVE-2020-2254

  Path traversal vulnerability in Blue Ocean Plugin

  Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean Web / CMS Maven
  Sep 16, 2020
• Medium 4.8
  CVE-2020-2252

  Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin

  Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.

  Jenkins Project Jenkins Mailer Plugin org.jenkins-ci.plugins:mailer Web / CMS Maven
  Sep 16, 2020
• Medium 4.7
  CVE-2020-8564

  Docker config secrets leaked when file is malformed and loglevel >= 4

  In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v…

  Kubernetes Kubernetes spark-operator k8s.io/kubernetes Debian Wolfi Go
  Dec 7, 2020
• Medium 4.3
  CVE-2020-2255

  Missing permission check in Blue Ocean Plugin

  A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean Web / CMS Maven
  Sep 16, 2020
• Unscored —
  CVE-2020-15586

  Data race and crash in net/http

  Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Jul 17, 2020
• Unscored —
  CVE-2020-16845

  Unbounded read from invalid inputs in encoding/binary

  Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Aug 6, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819663
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1853652
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1867099
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1874268
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1880454
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1880456
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1880460
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1886637
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4297.json
• report
  https://access.redhat.com/security/cve/CVE-2019-16541
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16541
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16541
• article
  https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1106
• report
  https://access.redhat.com/security/cve/CVE-2020-2252
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2252
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2252
• article
  https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813
• article
  https://www.openwall.com/lists/oss-security/2020/09/16/3
• report
  https://access.redhat.com/security/cve/CVE-2020-2254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2254
• article
  http://www.openwall.com/lists/oss-security/2020/09/16/3
• article
  https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1956
• report
  https://access.redhat.com/security/cve/CVE-2020-2255
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2255
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2255
• article
  https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1961
• report
  https://access.redhat.com/security/cve/CVE-2020-8564
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8564
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8564
• article
  https://github.com/kubernetes/kubernetes/issues/95622
• article
  https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
• report
  https://access.redhat.com/security/cve/CVE-2020-14040
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14040
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14040
• article
  https://github.com/golang/go/issues/39491
• article
  https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
• report
  https://access.redhat.com/security/cve/CVE-2020-14370