Red Hat Security Advisory: OpenShift Container Platform 4.10.52 security update

Fixed packages 2

Vulnerabilities 2

• High 8.3
  CVE-2022-1471 Public exploit EPSS 100%

  Remote Code execution in SnakeYAML

  SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  Dec 1, 2022
• Medium 5.3
  CVE-2022-34174

  Observable timing discrepancy allows determining username validity in Jenkins

  In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkin…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jun 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2119653
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150009
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0697.json
• report
  https://access.redhat.com/security/cve/CVE-2022-1471
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1471
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1471
• article
  https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
• report
  https://access.redhat.com/security/cve/CVE-2022-34174
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-34174
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-34174
• article
  https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566