Red Hat Security Advisory: OpenShift Container Platform 4.10.12 security update

Fixed packages 4

Vulnerabilities 4

• Medium 5.4
  CVE-2022-29036 EPSS 72%

  Cross-site Scripting in Jenkins Credentials Plugin

  Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cros…

  Jenkins Project Jenkins Credentials Plugin org.jenkins-ci.plugins:credentials Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29041

  Stored Cross-site Scripting vulnerability in Jenkins Jira Plugin

  Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke…

  Jenkins Project Jenkins JIRA Plugin org.jenkins-ci.plugins:jira Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29046

  Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin

  Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with It…

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Apr 12, 2022
• Medium 4.8
  CVE-2022-27652

  Incorrect Default Permissions in CRI-O

  A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw al…

  github.com/cri-o/cri-o Go
  Apr 18, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064161
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2079307
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1600.json
• report
  https://access.redhat.com/security/cve/CVE-2022-27652
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-27652
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-27652
• article
  https://github.com/cri-o/cri-o/security/advisories/GHSA-4hj2-r2pm-3hc6
• report
  https://access.redhat.com/security/cve/CVE-2022-29036
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074847
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29036
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29036
• article
  https://www.jenkins.io/security/advisory/2022-04-12/
• report
  https://access.redhat.com/security/cve/CVE-2022-29041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074850
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29041
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29041
• report
  https://access.redhat.com/security/cve/CVE-2022-29046
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074851
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29046
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29046