Read the docs
Red Hat Security Advisory

RHSA-2021:0429

OpenShift Container Platform 4.5.33 packages and security update

Released 2021-03-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 13 records

TI-2020-09639 CVE-2020-11979 · GHSA-f62v-xpxf-3v68

Injection in Apache Ant

Priority MEDIUM 49

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07757 Published 2020-10-01 Partial fix · 1.10.9 CWE-379
TI-2021-04685 CVE-2021-21605 · GHSA-pxgq-gqr9-5gwx

Path traversal in Jenkins

Priority LOW 39

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.02246 Published 2021-01-13 Fixed in 2.263.2, 2.275 CWE-22
TI-2021-04684 CVE-2021-21604 · GHSA-qv6f-rcv6-6q3x

Deserialization of untrusted data in Jenkins

Priority LOW 38

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01697 Published 2021-01-13 Fixed in 2.263.2, 2.275 CWE-502
TI-2021-04682 CVE-2021-21602 · GHSA-vpjm-58cw-r8q5

Link following in Jenkins

Priority LOW 33

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02253 Published 2021-01-13 Fixed in 2.263.2, 2.275 CWE-59
TI-2021-04687 CVE-2021-21607 · GHSA-cxqw-vjcr-gp5g

Resource allocation without limits in Jenkins

Priority LOW 32

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potential…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01462 Published 2021-01-13 Fixed in 2.263.2, 2.275 CWE-770
TI-2020-01869 CVE-2020-1945 · GHSA-4p6w-m9wc-c9c9

Exposure of resource to wrong sphere in Apache Ant

Priority LOW 32

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.01769 Published 2020-05-14 Partial fix · 1.9.15, 1.10.8 CWE-668
TI-2021-04690 CVE-2021-21610 · GHSA-7qf3-c2q8-69m3

Cross-site scripting in Jenkins

Priority LOW 30

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS)…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01199 Published 2021-01-13 Fixed in 2.263.2, 2.275 CWE-79
TI-2021-04689 CVE-2021-21609 · GHSA-4625-q52w-39cx

Incorrect authorization in Jenkins

Priority LOW 27

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did hav…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01323 Published 2021-01-13 Fixed in 2.263.2, 2.275 CWE-863
TI-2021-04695 CVE-2021-21615 · GHSA-qxp6-27gw-99cj

Time-of-check time-of-use race condition in Jenkins

Priority LOW 26

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0091 Published 2021-01-26 Partial fix · 2.263.3, 2.276 CWE-367
TI-2021-04691 CVE-2021-21611 · GHSA-mj7q-cmf3-mg7h

Cross-site scripting in Jenkins

Priority LOW 26

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers a…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01041 Published 2021-01-13 Fixed in 2.263.2, 2.275 CWE-79
TI-2021-04688 CVE-2021-21608 · GHSA-wv63-gwr9-5c55

Cross-site scripting in Jenkins

Priority LOW 26

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labe…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01041 Published 2021-01-13 Fixed in 2.275 CWE-79
TI-2021-04683 CVE-2021-21603 · GHSA-98gq-6hxg-52r6

Cross-site scripting in Jenkins

Priority LOW 26

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01041 Published 2021-01-13 Fixed in 2.275 CWE-79
TI-2021-04686 CVE-2021-21606 · GHSA-f585-9fw3-rj2m

Improper input validation in Jenkins

Priority LOW 23

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short pa…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0123 Published 2021-01-13 Fixed in 2.263.2, 2.275 CWE-20