Red Hat Security Advisory: OpenShift Container Platform 3.11.634 security update

Fixed packages 2

Vulnerabilities 2

• High 8.8
  CVE-2022-20617 Public exploit

  OS command execution vulnerability in Jenkins Docker Commons Plugin

  Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configur…

  Jenkins Project Jenkins Docker Commons Plugin org.jenkins-ci.plugins:docker-commons Web / CMS Maven
  Jan 12, 2022
• Medium 4.3
  CVE-2022-20612

  Cross-Site Request Forgery in Jenkins

  A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 12, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1636993
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2041983
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044460
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044502
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0555.json
• report
  https://access.redhat.com/security/cve/CVE-2022-20612
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-20612
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-20612
• article
  https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558
• report
  https://access.redhat.com/security/cve/CVE-2022-20617
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-20617
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-20617
• article
  https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1878