Red Hat Security Advisory

RHSA-2021:1551

OpenShift Container Platform 4.7.11 security and bug fix update

Released 2021-05-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.7 cri-tools-1.20.0-2.el7, cri-tools-1.20.0-2.el8, jenkins-2.277.3.1620393611-1.el8 +2

Fixes 6 records

TI-2021-09394 CVE-2021-28165 · GHSA-26vr-8j45-3r4w

Uncontrolled resource consumption in Eclipse Jetty

HIGH 71

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.53861 Published 2021-04-01 Partial fix · 9.4.39, 10.0.2 +1 CWE-400

TI-2020-17201 CVE-2020-28362 · GHSA-gff4-9rfx-4pcw

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

LOW 39

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03859 Published 2020-11-18 Partial fix CWE-295

TI-2021-02209 CVE-2021-3114 · GHSA-gwfm-9vvh-63r3

In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate…

LOW 34

In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02699 Published 2021-01-26 Partial fix CWE-682

TI-2021-04719 CVE-2021-21639 · GHSA-pvwx-3jx5-24r2

Improper input validation in Jenkins

LOW 25

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.02725 Published 2021-04-07 Partial fix · 2.277.2, 2.287 CWE-20

TI-2021-04720 CVE-2021-21640 · GHSA-w2hv-rcqr-2h7r

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly…

LOW 24

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01905 Published 2021-04-07 Partial fix · 2.277.2, 2.287 CWE-240

TI-2021-09392 CVE-2021-28163 · GHSA-j6qj-j888-vvgq

Information disclosure in Eclipse Jetty

LOW 21

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadverte…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.0418 Published 2021-04-01 Partial fix · 9.4.39, 10.0.2 +1 CWE-200