Red Hat Security Advisory

RHSA-2019:3144

OpenShift Container Platform 3.11 jenkins security update

Released 2019-10-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.11 jenkins-2.176.3.1569349414-1.el7

Fixes 2 records

TI-2019-07693 CVE-2019-10384 · GHSA-vcr8-h8qp-qj8h

Cross-site request forgery in Jenkins

MEDIUM 41

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for th…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01572 Published 2019-08-28 Partial fix · 2.176.3, 2.192 CWE-352

TI-2019-07692 CVE-2019-10383 · GHSA-9m48-54pj-h248

Cross-site scripting in Jenkins

LOW 25

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScr…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01366 Published 2019-08-28 Partial fix · 2.176.3, 2.192 CWE-79