Red Hat Security Advisory: OpenShift Container Platform 4.5.27 packages and security update

Fixed packages 3

Vulnerabilities 7

• Medium 6.5
  CVE-2020-2304

  XXE vulnerability in Jenkins Subversion Plugin

  Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Nov 4, 2020
• Medium 6.5
  CVE-2020-2305

  XXE vulnerability in Jenkins Mercurial Plugin

  Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Mercurial Plugin org.jenkins-ci.plugins:mercurial Web / CMS Maven
  Nov 4, 2020
• Medium 6.5
  CVE-2020-26137

  CRLF injection in urllib3

  urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

  python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu Alpine PyPI
  Sep 29, 2020
• Medium 4.3
  CVE-2020-2306

  Missing Authorization in Jenkins Mercurial Plugin

  A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.

  Jenkins Project Jenkins Mercurial Plugin org.jenkins-ci.plugins:mercurial Web / CMS Maven
  Nov 4, 2020
• Medium 4.3
  CVE-2020-2307

  Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin

  Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.

  Jenkins Project Jenkins Kubernetes Plugin org.csanchez.jenkins.plugins:kubernetes Web / CMS Maven
  Nov 4, 2020
• Medium 4.3
  CVE-2020-2308

  Missing Authorization in Jenkins Kubernetes Plugin

  A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names.

  Jenkins Project Jenkins Kubernetes Plugin org.csanchez.jenkins.plugins:kubernetes Web / CMS Maven
  Nov 4, 2020
• Medium 4.3
  CVE-2020-2309

  Missing authorization in Jenkins Kubernetes Plugin

  A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  Jenkins Project Jenkins Kubernetes Plugin org.csanchez.jenkins.plugins:kubernetes Web / CMS Maven
  Nov 4, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1883632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895939
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895940
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895941
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895946
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1913121
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0034.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2304
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2304
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2304
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2145
• report
  https://access.redhat.com/security/cve/CVE-2020-2305
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2305
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2305
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115
• report
  https://access.redhat.com/security/cve/CVE-2020-2306
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2306
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2306
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104
• report
  https://access.redhat.com/security/cve/CVE-2020-2307
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2307
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2307
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646
• report
  https://access.redhat.com/security/cve/CVE-2020-2308
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2308
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2308
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2102
• report
  https://access.redhat.com/security/cve/CVE-2020-2309
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2309
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2309
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103
• report
  https://access.redhat.com/security/cve/CVE-2020-26137
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26137
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26137