Red Hat Security Advisory: OpenShift Container Platform 4.10.62 security update

Fixed packages 2

Vulnerabilities 6

• High 8.8
  CVE-2023-32981

  Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability

  An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

  Jenkins Project Jenkins Pipeline Utility Steps Plugin org.jenkins-ci.plugins:pipeline-utility-steps Web / CMS Maven
  May 16, 2023
• High 8.2
  CVE-2022-41966 Public exploit

  XStream Denial of Service via stack overflow

  XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…

  x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  Dec 27, 2022
• High 7.5
  CVE-2023-20860 Public exploit

  Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

  Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a securit…

  libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring Debian Ubuntu Maven
  Mar 27, 2023
• Medium 5.4
  CVE-2023-32977

  Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting

  Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.

  Jenkins Project Jenkins Pipeline: Job Plugin org.jenkins-ci.plugins.workflow:workflow-job Web / CMS Maven
  May 16, 2023
• Medium 4.3
  CVE-2023-32979

  Jenkins Email Extension Plugin missing permission check

  Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on…

  Jenkins Project Jenkins Email Extension Plugin org.jenkins-ci.plugins:email-ext Web / CMS Maven
  May 16, 2023
• Medium 4.3
  CVE-2023-32980

  Jenkins Email Extension Plugin Cross-Site Request Forgery vulnerability

  A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.

  Jenkins Project Jenkins Email Extension Plugin org.jenkins-ci.plugins:email-ext Web / CMS Maven
  May 16, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207830
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207831
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207833
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207835
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3625.json
• report
  https://access.redhat.com/security/cve/CVE-2022-41966
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41966
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41966
• article
  https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv
• report
  https://access.redhat.com/security/cve/CVE-2023-20860
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-20860
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-20860
• article
  https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861
• report
  https://access.redhat.com/security/cve/CVE-2023-32977
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32977
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32977
• article
  https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3042
• report
  https://access.redhat.com/security/cve/CVE-2023-32979
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32979
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32979
• article
  https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3088%20(1)
• report
  https://access.redhat.com/security/cve/CVE-2023-32980
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32980
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32980
• article
  https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3088%20(2)
• report
  https://access.redhat.com/security/cve/CVE-2023-32981
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32981
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32981
• article
  https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2196