Red Hat Security Advisory

RHSA-2022:0491

OpenShift Container Platform 4.7.43 security update

Released 2022-02-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.7 jenkins-2-plugins-4.7.1643883495-1.el8, jenkins-2.319.2.1643882372-1.el8

Fixes 2 records

TI-2022-05176 CVE-2022-20617 · GHSA-jpxj-vgq5-prjc

OS command injection in Jenkins Docker Commons Plugin

MEDIUM 43

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to contro…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02332 Published 2022-01-12 Fixed in 1.18 CWE-78

TI-2022-05171 CVE-2022-20612 · GHSA-p92q-7fhh-mq35

Cross-site request forgery in Jenkins

LOW 24

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01873 Published 2022-01-12 Fixed in 2.330, 2.319.2 CWE-352