Red Hat Security Advisory

RHSA-2020:3579

OpenShift Container Platform 4.4.19 openshift security update

Released 2020-09-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.4 openshift-4.4.0-202008250319.p0.git.0.d653415.el7, openshift-4.4.0-202008250319.p0.git.0.d653415.el8, openshift-hyperkube-4.4.0-202008250319.p0.git.0.d653415.el7 +1

Fixes 5 records

TI-2020-02099 CVE-2020-2222 · GHSA-864v-5q2g-fr64

Cross-site scripting in Jenkins

LOW 27

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01126 Published 2020-07-15 Fixed in 2.235.2, 2.245 CWE-79

TI-2020-02098 CVE-2020-2221 · GHSA-g4j6-m3m3-crw8

Cross-site scripting in Jenkins

LOW 27

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01077 Published 2020-07-15 Fixed in 2.235.2, 2.245 CWE-79

TI-2020-02100 CVE-2020-2223 · GHSA-gfhj-524q-gcrm

Cross-site scripting in Jenkins

LOW 26

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01032 Published 2020-07-15 Fixed in 2.235.2, 2.245 CWE-79

TI-2020-02097 CVE-2020-2220 · GHSA-qgj4-rc8m-44mq

Cross-site scripting in Jenkins

LOW 26

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01023 Published 2020-07-15 Fixed in 2.235.2, 2.245 CWE-79

TI-2020-06856 CVE-2020-8557 · GHSA-55qj-gj3x-jq9r

Kubernetes node disk Denial of Service by writing to container /etc/hosts

LOW 25

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00434 Published 2020-07-23 Fixed in 1.18.6, 1.17.9 +1 CWE-400