Red Hat Security Advisory: OpenShift Container Platform 4.6.12 packages and security update

Fixed packages 13

Vulnerabilities 7

• Medium 6.5
  CVE-2020-2304

  XXE vulnerability in Jenkins Subversion Plugin

  Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Nov 4, 2020
• Medium 6.5
  CVE-2020-2305

  XXE vulnerability in Jenkins Mercurial Plugin

  Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Mercurial Plugin org.jenkins-ci.plugins:mercurial Web / CMS Maven
  Nov 4, 2020
• Medium 4.3
  CVE-2020-2306

  Missing Authorization in Jenkins Mercurial Plugin

  A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.

  Jenkins Project Jenkins Mercurial Plugin org.jenkins-ci.plugins:mercurial Web / CMS Maven
  Nov 4, 2020
• Medium 4.3
  CVE-2020-2307

  Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin

  Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.

  Jenkins Project Jenkins Kubernetes Plugin org.csanchez.jenkins.plugins:kubernetes Web / CMS Maven
  Nov 4, 2020
• Medium 4.3
  CVE-2020-2308

  Missing Authorization in Jenkins Kubernetes Plugin

  A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names.

  Jenkins Project Jenkins Kubernetes Plugin org.csanchez.jenkins.plugins:kubernetes Web / CMS Maven
  Nov 4, 2020
• Medium 4.3
  CVE-2020-2309

  Missing authorization in Jenkins Kubernetes Plugin

  A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  Jenkins Project Jenkins Kubernetes Plugin org.csanchez.jenkins.plugins:kubernetes Web / CMS Maven
  Nov 4, 2020
• Unscored —
  CVE-2020-28362

  Panic during division of very large numbers in math/big

  Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

  golang go stdlib golang-1.14 Debian Ubuntu Azure Linux Alpine Go
  Nov 18, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895939
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895940
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895941
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895946
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1897635
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0038.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2304
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2304
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2304
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2145
• report
  https://access.redhat.com/security/cve/CVE-2020-2305
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2305
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2305
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115
• report
  https://access.redhat.com/security/cve/CVE-2020-2306
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2306
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2306
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104
• report
  https://access.redhat.com/security/cve/CVE-2020-2307
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2307
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2307
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646
• report
  https://access.redhat.com/security/cve/CVE-2020-2308
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2308
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2308
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2102
• report
  https://access.redhat.com/security/cve/CVE-2020-2309
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2309
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2309
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103
• report
  https://access.redhat.com/security/cve/CVE-2020-28362
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28362