Red Hat Security Advisory: OpenShift Container Platform 4.7.13 packages and security update

Fixed packages 9

Vulnerabilities 6

• High 8.1
  CVE-2021-21642 EPSS 38%

  XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin

  Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Medium 6.5
  CVE-2021-21643

  Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs

  Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Medium 5.4
  CVE-2021-21644

  CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files

  A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Medium 4.3
  CVE-2021-21645

  Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs

  Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Unscored —
  CVE-2020-15586

  Data race and crash in net/http

  Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Jul 17, 2020
• Unscored —
  CVE-2020-16845

  Unbounded read from invalid inputs in encoding/binary

  Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Aug 6, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1856953
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1867099
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952146
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952148
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952151
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952152
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1964770
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2122.json
• report
  https://access.redhat.com/security/cve/CVE-2020-15586
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15586
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15586
• article
  https://groups.google.com/g/golang-announce/c/XZNfaiwgt2w/m/E6gHDs32AQAJ
• report
  https://access.redhat.com/security/cve/CVE-2020-16845
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-16845
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-16845
• article
  https://groups.google.com/g/golang-announce/c/NyPIaucMgXo
• report
  https://access.redhat.com/security/cve/CVE-2021-21642
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21642
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21642
• article
  https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2204
• report
  https://access.redhat.com/security/cve/CVE-2021-21643
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21643
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21643
• article
  https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254
• report
  https://access.redhat.com/security/cve/CVE-2021-21644
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21644
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21644
• report
  https://access.redhat.com/security/cve/CVE-2021-21645
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21645
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21645