Red Hat Security Advisory: OpenShift Container Platform 4.4.33 packages and security update

Fixed packages 1

Vulnerabilities 2

• Medium 6.5
  CVE-2020-2304

  XXE vulnerability in Jenkins Subversion Plugin

  Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Nov 4, 2020
• Medium 6.5
  CVE-2020-2305

  XXE vulnerability in Jenkins Mercurial Plugin

  Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Mercurial Plugin org.jenkins-ci.plugins:mercurial Web / CMS Maven
  Nov 4, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895939
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895940
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1921164
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0282.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2304
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2304
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2304
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2145
• report
  https://access.redhat.com/security/cve/CVE-2020-2305
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2305
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2305
• article
  https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115