Read the docs
Red Hat Security Advisory

RHSA-2022:1420

OpenShift Container Platform 3.11.685 security and bug fix update

Released 2022-04-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 13 records

TI-2022-08895 CVE-2022-25182 · GHSA-7rcw-fwfh-2h2g

Protection mechanism failure in Jenkins Pipeline: Shared Groovy Libraries Plugin

Priority MEDIUM 43

A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM usi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01601 Published 2022-02-15 Fixed in 2.21.1, 2.18.1 +1 CWE-693
TI-2022-08896 CVE-2022-25183 · GHSA-pfwp-q984-w7wh

Protection mechanism failure in Jenkins Pipeline: Shared Groovy Libraries Plugin

Priority MEDIUM 41

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01571 Published 2022-02-15 Fixed in 2.21.1, 561.va_ce0de3c2d69 CWE-693
TI-2022-08894 CVE-2022-25181 · GHSA-7w2w-fwpf-9m4h

Protection mechanism failure in Jenkins Pipeline: Shared Groovy Libraries Plugin

Priority MEDIUM 41

A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins con…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01601 Published 2022-02-15 Fixed in 2.21.1, 2.18.1 +1 CWE-693
TI-2022-08888 CVE-2022-25175 · GHSA-pj84-qjm3-77mg

OS command injection in Jenkins Pipeline: Multibranch Plugin

Priority MEDIUM 41

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS c…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01404 Published 2022-02-15 Fixed in 2.26.1, 2.23.1 +2 CWE-78
TI-2022-08887 CVE-2022-25174 · GHSA-g9fx-6j5c-grmw

OS command injection in Jenkins Pipeline: Shared Groovy Libraries Plugin

Priority MEDIUM 41

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01404 Published 2022-02-15 Fixed in 2.21.1, 2.18.1 +1 CWE-78
TI-2022-08886 CVE-2022-25173 · GHSA-4m7p-55jm-3vwv

OS command injection in Jenkins Pipeline: Groovy Plugin

Priority MEDIUM 41

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configu…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01444 Published 2022-02-15 Fixed in 2.94.1, 2.92.1 +1 CWE-78
TI-2022-08892 CVE-2022-25179 · GHSA-2m9w-9xh2-wxc3

Link following in Jenkins Pipeline: Multibranch Plugin

Priority LOW 32

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing atta…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01786 Published 2022-02-15 Fixed in 2.26.1, 2.23.1 +2 CWE-59
TI-2022-08891 CVE-2022-25178 · GHSA-5hfv-mg5x-mv32

Path traversal in Jenkins Pipeline: Shared Groovy Libraries Plugin

Priority LOW 32

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to rea…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01668 Published 2022-02-15 Fixed in 2.21.1, 2.18.1 +1 CWE-22
TI-2022-08890 CVE-2022-25177 · GHSA-q234-x887-9rxh

Link following in Jenkins Pipeline: Shared Groovy Libraries Plugin

Priority LOW 32

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing atta…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01742 Published 2022-02-15 Fixed in 2.21.1, 2.18.1 +1 CWE-59
TI-2022-08889 CVE-2022-25176 · GHSA-6473-gqrj-4p65

Link following in Jenkins Pipeline: Groovy Plugin

Priority LOW 32

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelin…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01742 Published 2022-02-15 Fixed in 2.94.1, 2.92.1 +1 CWE-59
TI-2022-08897 CVE-2022-25184 · GHSA-g84f-cmc8-682c

Insufficiently protected credentials in Jenkins Pipeline: Build Step Plugin

Priority LOW 30

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retri…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00876 Published 2022-02-15 Fixed in 2.13.1, 2.15.1 CWE-522
TI-2022-08893 CVE-2022-25180 · GHSA-qv6q-x9vr-w7j3

Cleartext transmission of sensitive information in Jenkins Pipeline: Groovy Plugin

Priority LOW 21

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password param…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00528 Published 2022-02-15 Fixed in 2.94.1, 2.92.1 +1 CWE-319