Red Hat Security Advisory

RHSA-2020:3841

OpenShift Container Platform 4.5.13 jenkins security update

Released 2020-09-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.5 jenkins-2.235.5.1600414805-1.el7

Fixes 4 records

TI-2020-02107 CVE-2020-2230 · GHSA-9g4m-ffx6-c29g

Cross-site scripting in Jenkins

HIGH 65

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permissi…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.82733 Published 2020-08-12 Fixed in 2.235.4, 2.252 CWE-79

TI-2019-13163 CVE-2019-17638 · GHSA-x3rh-m7vp-35f2

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large…

MEDIUM 54

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.11138 Published 2020-07-09 Fixed in 9.4.30.v20200611 CWE-672

TI-2020-02106 CVE-2020-2229 · GHSA-hvmc-7g2x-r3p9

Cross-site scripting in Jenkins

LOW 34

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.06765 Published 2020-08-12 Fixed in 2.235.4, 2.252 CWE-79

TI-2020-02108 CVE-2020-2231 · GHSA-jpvq-v729-7j2h

Cross-site scripting in Jenkins

LOW 33

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.05298 Published 2020-08-12 Fixed in 2.235.4, 2.252 CWE-79