Red Hat Security Advisory: OpenShift Container Platform 4.9.33 packages and security update

Fixed packages 1

Vulnerabilities 4

• High 7.3
  CVE-2022-29047

  Untrusted users can modify some Pipeline libraries in Jenkins Pipeline: Deprecated Groovy Libraries Plugin

  Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior…

  Jenkins Project Jenkins Pipeline: Shared Groovy Libraries Plugin org.jenkins-ci.plugins.workflow:workflow-cps-global-lib Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29036 EPSS 72%

  Cross-site Scripting in Jenkins Credentials Plugin

  Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cros…

  Jenkins Project Jenkins Credentials Plugin org.jenkins-ci.plugins:credentials Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29041

  Stored Cross-site Scripting vulnerability in Jenkins Jira Plugin

  Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke…

  Jenkins Project Jenkins JIRA Plugin org.jenkins-ci.plugins:jira Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29046

  Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin

  Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with It…

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Apr 12, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074847
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074850
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074851
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074855
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2205.json
• report
  https://access.redhat.com/security/cve/CVE-2022-29036
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29036
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29036
• article
  https://www.jenkins.io/security/advisory/2022-04-12/
• report
  https://access.redhat.com/security/cve/CVE-2022-29041
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29041
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29041
• report
  https://access.redhat.com/security/cve/CVE-2022-29046
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29046
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29046
• report
  https://access.redhat.com/security/cve/CVE-2022-29047
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29047
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29047
• article
  https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951