Red Hat Security Advisory: OpenShift Container Platform 3.11.705 security update

Fixed packages 2

Vulnerabilities 3

• High 7.5
  CVE-2022-21698

  Uncontrolled Resource Consumption in promhttp

  client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Ser…

  prometheus client_golang cri-o dynamic-localpv-provisioner Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 15, 2022
• Medium 5.4
  CVE-2022-29036 EPSS 72%

  Cross-site Scripting in Jenkins Credentials Plugin

  Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cros…

  Jenkins Project Jenkins Credentials Plugin org.jenkins-ci.plugins:credentials Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29046

  Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin

  Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with It…

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Apr 12, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2045880
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2071682
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074847
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074851
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2280.json
• report
  https://access.redhat.com/security/cve/CVE-2022-21698
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-21698
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-21698
• article
  https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p
• report
  https://access.redhat.com/security/cve/CVE-2022-29036
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29036
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29036
• article
  https://www.jenkins.io/security/advisory/2022-04-12/
• report
  https://access.redhat.com/security/cve/CVE-2022-29046
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29046
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29046