Red Hat Security Advisory

RHSA-2019:2503

OpenShift Container Platform 3.11 jenkins security update

Released 2019-08-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.11 jenkins-2.176.2.1563460897-1.el7

Fixes 3 records

TI-2019-07661 CVE-2019-10352 · GHSA-qr42-82qj-mw65

Path traversal in Jenkins

MEDIUM 41

A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter w…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.10042 Published 2019-07-17 Partial fix · 2.176.2, 2.186 CWE-22

TI-2019-07662 CVE-2019-10353 · GHSA-hcxf-rq72-h4rr

Cross-site request forgery in Jenkins

LOW 36

CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

CVSS 3.0HIGH 7.5 Network No auth User interaction EPSS 0.01502 Published 2019-07-17 Partial fix · 2.176.2, 2.186 CWE-352

TI-2019-07663 CVE-2019-10354 · GHSA-6jfc-mc97-c7wg

Missing authorization in Jenkins

LOW 23

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive infor…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01617 Published 2019-07-17 Partial fix · 2.176.2, 2.186 +1 CWE-862