Red Hat Security Advisory

RHSA-2021:2122

OpenShift Container Platform 4.7.13 packages and security update

Released 2021-06-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.7 cri-o-1.20.2-12.rhaos4.7.git9f7be76.el7, cri-o-1.20.2-12.rhaos4.7.git9f7be76.el8, cri-tools-1.20.0-3.el7 +2

Fixes 6 records

TI-2021-04722 CVE-2021-21642 · GHSA-q7xg-hh3q-hc68

XML external entity injection in Jenkins Config File Provider Plugin

MEDIUM 62

Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.3783 Published 2021-04-21 Fixed in 3.7.1 CWE-611

TI-2020-12850 CVE-2020-16845

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint…

MEDIUM 41

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04861 Published 2020-08-06 Partial fix CWE-835

TI-2020-12262 CVE-2020-15586 · GHSA-9rmg-8r3f-xrq7

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as…

LOW 32

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02883 Published 2020-07-17 Partial fix CWE-362

TI-2021-04723 CVE-2021-21643 · GHSA-3m3f-2323-64m7

Incorrect authorization in Jenkins Config File Provider Plugin

LOW 31

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01082 Published 2021-04-21 Fixed in 3.7.1 CWE-863

TI-2021-04724 CVE-2021-21644 · GHSA-998m-f2x3-jjq4

Cross-site request forgery in Jenkins Config File Provider Plugin

LOW 27

A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.01053 Published 2021-04-21 Fixed in 3.7.1 CWE-352

TI-2021-04725 CVE-2021-21645 · GHSA-2959-fj73-hm8p

Missing authorization in Jenkins Config File Provider Plugin

LOW 22

Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00887 Published 2021-04-21 Fixed in 3.7.1 CWE-862