Red Hat Security Advisory

RHSA-2022:2280

OpenShift Container Platform 3.11.705 security update

Released 2022-05-31 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.11 atomic-openshift-dockerregistry-3.11.705-1.g0fa231c.el7, jenkins-2-plugins-3.11.1650628887-1.el7

Fixes 3 records

TI-2022-11602 CVE-2022-29036 · GHSA-rvg5-f5fj-mxvg

Cross-site scripting in Jenkins Credentials Plugin

MEDIUM 62

Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.71926 Published 2022-04-12 Fixed in 2.6.1.1, 1074.1076.v39c30cecb_0e2 +1 CWE-79

TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p

Uncontrolled Resource Consumption in promhttp

MEDIUM 48

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05994 Published 2022-02-15 Partial fix · 1.11.1 CWE-400

TI-2022-11612 CVE-2022-29046 · GHSA-wpr6-qvcq-8269

Cross-site scripting in Jenkins Subversion Plugin

LOW 29

Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnera…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02512 Published 2022-04-12 Fixed in 2.15.4 CWE-79