Red Hat Security Advisory

RHSA-2019:1851

OpenShift Container Platform 3.11 security update

Released 2019-07-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.129-1.git.0.bd4f2d5.el7, atomic-openshift-clients-3.11.129-1.git.0.bd4f2d5.el7, atomic-openshift-clients-redistributable-3.11.129-1.git.0.bd4f2d5.el7 +11

Fixes 3 records

TI-2019-15843 CVE-2019-1002100 · GHSA-q4rr-64r9-fwgf

Resource allocation without limits in Kubernetes

MEDIUM 46

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.16934 Published 2019-04-01 Partial fix · v1.11.8, v1.12.6 +4 CWE-770

TI-2019-07646 CVE-2019-10337 · GHSA-g6h2-4x64-c59x

XML external entity injection in Jenkins Token Macro Plugin

LOW 37

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities,…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02038 Published 2019-06-11 Partial fix · 2.8 CWE-611

TI-2019-02886 CVE-2019-3876

Cross-site request forgery in Red Hat web-console

LOW 29

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00672 Published 2019-04-01 Partial fix CWE-352