Red Hat Security Advisory: OpenShift Container Platform 3.11.318 jenkins-2-plugins security update

Fixed packages 1

Vulnerabilities 3

• Medium 5.3
  CVE-2020-2254

  Path traversal vulnerability in Blue Ocean Plugin

  Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean Web / CMS Maven
  Sep 16, 2020
• Medium 4.8
  CVE-2020-2252

  Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin

  Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.

  Jenkins Project Jenkins Mailer Plugin org.jenkins-ci.plugins:mailer Web / CMS Maven
  Sep 16, 2020
• Medium 4.3
  CVE-2020-2255

  Missing permission check in Blue Ocean Plugin

  A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean Web / CMS Maven
  Sep 16, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1880454
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1880456
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1880460
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5102.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2252
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2252
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2252
• article
  https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813
• article
  https://www.openwall.com/lists/oss-security/2020/09/16/3
• report
  https://access.redhat.com/security/cve/CVE-2020-2254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2254
• article
  http://www.openwall.com/lists/oss-security/2020/09/16/3
• article
  https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1956
• report
  https://access.redhat.com/security/cve/CVE-2020-2255
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2255
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2255
• article
  https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1961