Red Hat Security Advisory: OpenShift Container Platform 4.6.59 security update

Fixed packages 8

Vulnerabilities 3

• High 7.5
  CVE-2022-1708

  Node DOS by way of memory exhaustion through ExecSync request in CRI-O

  A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after co…

  cri-o github.com/cri-o/cri-o cri-o Azure Linux Alpine Go
  Jun 7, 2022
• Medium 5.4
  CVE-2022-29036 EPSS 72%

  Cross-site Scripting in Jenkins Credentials Plugin

  Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cros…

  Jenkins Project Jenkins Credentials Plugin org.jenkins-ci.plugins:credentials Web / CMS Maven
  Apr 12, 2022
• Medium 5.4
  CVE-2022-29046

  Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin

  Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with It…

  Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven
  Apr 12, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074847
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074851
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2085361
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4947.json
• report
  https://access.redhat.com/security/cve/CVE-2022-1708
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1708
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1708
• article
  https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j
• report
  https://access.redhat.com/security/cve/CVE-2022-29036
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29036
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29036
• article
  https://www.jenkins.io/security/advisory/2022-04-12/
• report
  https://access.redhat.com/security/cve/CVE-2022-29046
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29046
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29046