A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Assembla merge request builder Plugin
*   Azure Key Vault Plugin
*   Consul KV Builder Plugin
*   Fogbugz Plugin
*   Image Tag Parameter Plugin
*   Kubernetes Plugin
*   Lucene-Search Plugin
*   NeuVector Vulnerability Scanner Plugin
*   Quay.io trigger Plugin
*   Report Portal Plugin
*   Thycotic DevOps Secrets Vault Plugin
*   Thycotic Secret Server Plugin
*   TurboScript Plugin
*   WSO2 Oauth Plugin

**Descriptions****Improper masking of credentials in multiple plugins**

**SECURITY-3075 / CVE-2023-30513 (Kubernetes), CVE-2023-30514 (Azure Key Vault), CVE-2023-30515 (Thycotic DevOps Secrets Vault)**  
**Severity (CVSS):** Medium  
**Affected plugins: kubernetes , azure-keyvault , thycotic-devops-secrets-vault**  
**Description:**

Multiple plugins do not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met:

*   The credentials are printed in build steps executing on an agent (typically inside a node block).
    
*   Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch.
    

The following plugins are affected by this vulnerability:

*   Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 / CVE-2023-30513)
    
*   Azure Key Vault 187.va\_cd5fecd198a\_ and earlier (SECURITY-3051 / CVE-2023-30514)
    
*   Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)
    

The following plugins have been updated to properly mask credentials in the build log when push mode for durable task logging is enabled:

*   Kubernetes 3910.ve59cec5e33ea\_ (SECURITY-3079 / CVE-2023-30513)
    
*   Azure Key Vault 188.vf46b\_7fa\_846a\_1 (SECURITY-3051 / CVE-2023-30514)
    

As of publication of this advisory, there is no fix available for the following plugin:

*   Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)
    

An improvement in Credentials Binding 523.525.vb\_72269281873 implements a workaround that applies build log masking even in affected plugins. This workaround is temporary and potentially incomplete, so it is still recommended that affected plugins be updated to resolve this issue.

**Disabled SSL/TLS certificate validation for existing configurations in Image Tag Parameter Plugin**

**SECURITY-2840 / CVE-2023-30516**  
**Severity (CVSS):** Medium  
**Affected plugin: image-tag-parameter**  
**Description:**

Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries.

Job configurations using Image Tag Parameters that were created before 2.0 will have SSL/TLS certificate validation disabled by default.

**SSL/TLS certificate validation unconditionally disabled by NeuVector Vulnerability Scanner Plugin**

**SECURITY-2841 / CVE-2023-30517**  
**Severity (CVSS):** Medium  
**Affected plugin: neuvector-vulnerability-scanner**  
**Description:**

NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.

**Missing permission check in Thycotic Secret Server Plugin allows enumerating credentials IDs**

**SECURITY-2837 / CVE-2023-30518**  
**Severity (CVSS):** Medium  
**Affected plugin: thycotic-secret-server**  
**Description:**

Thycotic Secret Server Plugin 1.0.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**Lack of authentication mechanism in Quay.io trigger Plugin webhook**

**SECURITY-2849 / CVE-2023-30519**  
**Severity (CVSS):** Medium  
**Affected plugin: quayio-trigger**  
**Description:**

Quay.io trigger Plugin provides a webhook endpoint at /quayio-webhook/ that can be used to trigger builds of jobs configured to use a specified repository.

In Quay.io trigger Plugin 0.1 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

**Stored XSS vulnerability in Quay.io trigger Plugin**

**SECURITY-2850 / CVE-2023-30520**  
**Severity (CVSS):** High  
**Affected plugin: quayio-trigger**  
**Description:**

Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.

**Lack of authentication mechanism in Assembla merge request builder Plugin webhook**

**SECURITY-2872 / CVE-2023-30521**  
**Severity (CVSS):** Medium  
**Affected plugin: assembla-merge-request-builder**  
**Description:**

Assembla merge request builder Plugin provides a webhook endpoint at /assembla-webhook/ that can be used to trigger builds of jobs configured to use a specified repository.

In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

**Lack of authentication mechanism in Fogbugz Plugin webhook**

**SECURITY-2873 / CVE-2023-30522**  
**Severity (CVSS):** Medium  
**Affected plugin: fogbugz**  
**Description:**

Fogbugz Plugin provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs.

In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request parameter.

**Tokens stored and displayed in plain text by Report Portal Plugin**

**SECURITY-2945 / CVE-2023-30523 (storage), CVE-2023-30524 (masking)**  
**Severity (CVSS):** Medium  
**Affected plugin: reportportal**  
**Description:**

Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.

**CSRF vulnerability and missing permission check in Report Portal Plugin**

**SECURITY-2950 / CVE-2023-30525 (CSRF), CVE-2023-30526 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: reportportal**  
**Description:**

Report Portal Plugin 0.5 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Client secret stored and displayed in plain text by WSO2 Oauth Plugin**

**SECURITY-2992 / CVE-2023-30527 (storage), CVE-2023-30528 (masking)**  
**Severity (CVSS):** Low  
**Affected plugin: wso2id-oauth**  
**Description:**

WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the WSO2 Oauth client secret, increasing the potential for attackers to observe and capture it.

**CSRF vulnerability in Lucene-Search Plugin**

**SECURITY-3013 / CVE-2023-30529**  
**Severity (CVSS):** Medium  
**Affected plugin: lucene-search**  
**Description:**

Lucene-Search Plugin 387.v938a\_ecb\_f7fe9 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to reindex the database.

**Token stored and displayed in plain text by Consul KV Builder Plugin**

**SECURITY-2944 / CVE-2023-30530 (storage), CVE-2023-30531 (masking)**  
**Severity (CVSS):** Medium  
**Affected plugin: consul-kv-builder**  
**Description:**

Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml on the Jenkins controller as part of its configuration.

This token can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the token, increasing the potential for attackers to observe and capture it.

**Lack of authentication mechanism in TurboScript Plugin webhook**

**SECURITY-2851 / CVE-2023-30532**  
**Severity (CVSS):** Medium  
**Affected plugin: spoonscript**  
**Description:**

TurboScript Plugin provides a webhook endpoint at /turbo-webhook/ that can be used to trigger builds of jobs configured to use a specified repository.

In TurboScript Plugin 1.3 and earlier, this endpoint can be accessed by attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository.

**Severity**

*   SECURITY-2837: Medium
*   SECURITY-2840: Medium
*   SECURITY-2841: Medium
*   SECURITY-2849: Medium
*   SECURITY-2850: High
*   SECURITY-2851: Medium
*   SECURITY-2872: Medium
*   SECURITY-2873: Medium
*   SECURITY-2944: Medium
*   SECURITY-2945: Medium
*   SECURITY-2950: Medium
*   SECURITY-2992: Low
*   SECURITY-3013: Medium
*   SECURITY-3075: Medium

**Affected Versions**

*   **Assembla merge request builder Plugin** up to and including 1.1.13
*   **Azure Key Vault Plugin** up to and including 187.va\_cd5fecd198a\_
*   **Consul KV Builder Plugin** up to and including 2.0.13
*   **Fogbugz Plugin** up to and including 2.2.17
*   **Image Tag Parameter Plugin** up to and including 2.0
*   **Kubernetes Plugin** up to and including 3909.v1f2c633e8590
*   **Lucene-Search Plugin** up to and including 387.v938a\_ecb\_f7fe9
*   **NeuVector Vulnerability Scanner Plugin** up to and including 1.22
*   **Quay.io trigger Plugin** up to and including 0.1
*   **Report Portal Plugin** up to and including 0.5
*   **Thycotic DevOps Secrets Vault Plugin** up to and including 1.0.0
*   **Thycotic Secret Server Plugin** up to and including 1.0.2
*   **TurboScript Plugin** up to and including 1.3
*   **WSO2 Oauth Plugin** up to and including 1.0

**Fix**

*   **Azure Key Vault Plugin** should be updated to version 188.vf46b\_7fa\_846a\_1
*   **Kubernetes Plugin** should be updated to version 3910.ve59cec5e33ea\_

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Assembla merge request builder Plugin
*   Consul KV Builder Plugin
*   Fogbugz Plugin
*   Image Tag Parameter Plugin
*   Lucene-Search Plugin
*   NeuVector Vulnerability Scanner Plugin
*   Quay.io trigger Plugin
*   Report Portal Plugin
*   Thycotic DevOps Secrets Vault Plugin
*   Thycotic Secret Server Plugin
*   TurboScript Plugin
*   WSO2 Oauth Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **CC Bomber, Kitri BoB** for SECURITY-2944, SECURITY-2945
*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2837, SECURITY-2840, SECURITY-3013
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2849, SECURITY-2850, SECURITY-2851, SECURITY-2992
*   **Kevin Guerroudj, CloudBees, Inc. and Yaroslav Afenkin, CloudBees, Inc.** for SECURITY-2873
*   **Pavel Nakonechnyi, Netcetera AG** for SECURITY-2841
*   **Tim Jacomb** for SECURITY-3075
*   **Yaroslav Afenkin, CloudBees, Inc.** for SECURITY-2950
*   **Yaroslav Afenkin, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2872

CVE-2023-30526: Jenkins Security Advisory 2023-04-12

Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.

CVE-2023-30531: Jenkins Security Advisory 2023-04-12

A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

CVE-2023-30521: Jenkins Security Advisory 2023-04-12

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it.

CVE-2023-30528: Jenkins Security Advisory 2023-04-12

Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

CVE-2023-30515: Jenkins Security Advisory 2023-04-12

A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository.

CVE-2023-30532: Jenkins Security Advisory 2023-04-12

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.

CVE-2023-30517: Jenkins Security Advisory 2023-04-12

Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database.

CVE-2023-30529: Jenkins Security Advisory 2023-04-12

Red Hat Security Advisory 2023-1656-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.10.56.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Container Platform 4.10.56 security update  
Advisory ID:       RHSA-2023:1656-01  
Product:           Red Hat OpenShift Enterprise  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:1656  
Issue date:        2023-04-12  
CVE Names:         CVE-2021-20329 CVE-2022-3172 CVE-2022-31690   
                   CVE-2022-31692 CVE-2022-42889 CVE-2023-0266   
                   CVE-2023-0286 CVE-2023-0461 CVE-2023-24422   
                   CVE-2023-27898 CVE-2023-27899 CVE-2023-27903   
                   CVE-2023-27904   
=====================================================================

1. Summary:

Red Hat OpenShift Container Platform release 4.10.56 is now available with  
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container  
Platform 4.10.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing  
Kubernetes application platform solution designed for on-premise or private  
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container  
Platform 4.10.56. See the following advisory for the RPM packages for this  
release:

https://access.redhat.com/errata/RHSA-2023:1655

Space precludes documenting all the container images in this advisory. See  
the following Release Notes documentation, which will be updated shortly  
for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html

Security Fix(es):

* mongo-go-driver: specific cstrings input may not be properly validated  
(CVE-2021-20329)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

All OpenShift Container Platform 4.10 users are advised to upgrade to these  
updated packages and images when they are available in the appropriate  
release channel. To check for available updates, use the OpenShift CLI (oc)  
or web console. Instructions for upgrading a cluster are available at  
https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html

3. Solution:

For OpenShift Container Platform 4.10 see the following documentation,  
which will be updated shortly for this release, for important instructions  
on how to upgrade your cluster and fully apply this asynchronous errata  
update:

https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html

You may download the oc tool and use it to inspect release image metadata  
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests  
may be found at  
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are

      (For x86_64 architecture)  
The image digest is  
sha256:60f6c51a852f084a020c3dc32b92cbd91ed293b82c6c5b48aac51460566688c7

      (For s390x architecture)  
The image digest is  
sha256:2307b63fe771e3f1ebd5eb30d9bdc429ecbfb86833943b61cdc48847e8e11461

      (For ppc64le architecture)  
The image digest is  
sha256:166f394473cca2a379a4915fb6631b7232078d7eb0e0eb7ef99133f8b6d48b9d

      (For aarch64 architecture)  
The image digest is  
sha256:7997b03ba9ee7477b242d57976244a8133fc4f8402a8cc83081accdc08d9a715

All OpenShift Container Platform 4.10 users are advised to upgrade to these  
updated packages and images when they are available in the appropriate  
release channel. To check for available updates, use the OpenShift CLI (oc)  
or web console. Instructions for upgrading a cluster are available at  
https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1971033 - CVE-2021-20329 mongo-go-driver: specific cstrings input may not be properly validated

5. JIRA issues fixed (https://issues.jboss.org/):

OCPBUGS-10491 - Prometheus continuously restarts due to slow WAL replay  
OCPBUGS-10524 - Traffic from egress IPs was interrupted after Cluster patch to Openshift 4.10.46  
OCPBUGS-10703 - MTU migration configuration is cleaned up prematurely while in progress  
OCPBUGS-10750 - 'oc adm upgrade channel ...' should not clobber unrecognized spec properties  
OCPBUGS-10777 - TestNewAppRun unit test failing  
OCPBUGS-10814 - Risk cache warming takes too long on channel changes  
OCPBUGS-11236 - Bump Jenkins to 2.387.1  
OCPBUGS-11238 - Jenkins images based on rhel8 are wrongly tagged with rhel7  
OCPBUGS-8314 - Bump to kubernetes 1.23.17

6. References:

https://access.redhat.com/security/cve/CVE-2021-20329  
https://access.redhat.com/security/cve/CVE-2022-3172  
https://access.redhat.com/security/cve/CVE-2022-31690  
https://access.redhat.com/security/cve/CVE-2022-31692  
https://access.redhat.com/security/cve/CVE-2022-42889  
https://access.redhat.com/security/cve/CVE-2023-0266  
https://access.redhat.com/security/cve/CVE-2023-0286  
https://access.redhat.com/security/cve/CVE-2023-0461  
https://access.redhat.com/security/cve/CVE-2023-24422  
https://access.redhat.com/security/cve/CVE-2023-27898  
https://access.redhat.com/security/cve/CVE-2023-27899  
https://access.redhat.com/security/cve/CVE-2023-27903  
https://access.redhat.com/security/cve/CVE-2023-27904  
https://access.redhat.com/security/updates/classification/#moderate  
https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html  
https://access.redhat.com/articles/11258

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZDbeftzjgjWX9erEAQi18g/9HjS5qch0p8gZxDq4ZSMSwcKbBfKdy7hn  
5Mzmpvw1RKeUZGdUBlPWF0zTUzNEimcaQ4RqApegxqxfMrfIihzrastTVWeXsx33  
TC1goYRygd2Swxe5lEZ7E/CS9FH7O3ggz0dGwAXKdz+DmXlGa8aoWRRzpzrp7vzi  
PD4Jwpe+t+acqmNQKDX7PdM58++1Yd+BOEMllkkbxFS6RpJ4JBBaY0TDLkJfU4hB  
0GJ4G9mdBDXuzlxj+jtc2DLMSvFQ5qAmGUxjTZLI8dFVbuCz52rTr9Ek414aiZw5  
3hGOCPPJq7jL9ruzTFBbkuus8nBVtTt914jb2emBKT2v7IM4YQK1i6UsCyDUue61  
34UhYC7N1L7n0lZe8RSTVCSYRLVL8+9Zdr1kAHAojJunABWgVXAJjZZdOXmlKOYR  
Rr/mbh+jRx3cWoiFaYwvtRPfwxknaE8fwdxIsQYfLxGOm6sdpSSPOFSTMmE+nMsy  
8+MCBoljCThwjXNZN6Z92NheRSvDdZQx90+sTF/u/YMFWiSu9t31OPT0nwQNudj9  
8MqlovebS/uLXTHHDpiVT/hackE17PGQnmgRslQFAHuBp5gsnpXpw0cGyIB9Jlc7  
6MRtbOCqao5A7TrRIiYWRRQzisK6laUam3y30WWDCCzXt/cacfm/kr9Ssx4eUc3m  
T9eS4aqy7Aw=  
=0HQs  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-1656-01

Red Hat Security Advisory 2023-1655-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.56. Issues addressed include bypass, cross site scripting, information leakage, insecure permissions, and privilege escalation vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 4.10.56 security update  
Advisory ID:       RHSA-2023:1655-01  
Product:           Red Hat OpenShift Enterprise  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:1655  
Issue date:        2023-04-12  
CVE Names:         CVE-2022-3172 CVE-2022-31690 CVE-2022-31692   
                   CVE-2022-42889 CVE-2023-24422 CVE-2023-27898   
                   CVE-2023-27899 CVE-2023-27903 CVE-2023-27904   
=====================================================================

1. Summary:

Red Hat OpenShift Container Platform release 4.10.56 is now available with  
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container  
Platform 4.10.

Red Hat Product Security has rated this update as having a security impact  
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 4.10 - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing  
Kubernetes application platform solution designed for on-premise or private  
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container  
Platform 4.10.56. See the following advisory for the container images for  
this release:

https://access.redhat.com/errata/RHSA-2023:1656

Security Fix(es):

* apache-commons-text: variable interpolation RCE (CVE-2022-42889)

* spring-security-oauth2-client: Privilege Escalation in  
spring-security-oauth2-client (CVE-2022-31690)

* spring-security: Authorization rules can be bypassed via forward or  
include dispatcher types in Spring Security (CVE-2022-31692)

* jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script  
Security Plugin (CVE-2023-24422)

* Jenkins: XSS vulnerability in plugin manager (CVE-2023-27898)

* Jenkins: Temporary plugin file created with insecure permissions  
(CVE-2023-27899)

* kube-apiserver: Aggregated API server can cause clients to be redirected  
(SSRF) (CVE-2022-3172)

* Jenkins: Temporary file parameter created with insecure permissions  
(CVE-2023-27903)

* Jenkins: Information disclosure through error stack traces related to  
agents (CVE-2023-27904)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For OpenShift Container Platform 4.10 see the following documentation,  
which will be updated shortly for this release, for important instructions  
on how to upgrade your cluster and fully apply this asynchronous errata  
update:

https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html

5. Bugs fixed (https://bugzilla.redhat.com/):

2127804 - CVE-2022-3172 kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF)  
2135435 - CVE-2022-42889 apache-commons-text: variable interpolation RCE  
2162200 - CVE-2022-31690 spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client  
2162206 - CVE-2022-31692 spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security  
2164278 - CVE-2023-24422 jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin  
2177626 - CVE-2023-27899 Jenkins: Temporary plugin file created with insecure permissions  
2177629 - CVE-2023-27898 Jenkins: XSS vulnerability in plugin manager  
2177632 - CVE-2023-27903 Jenkins: Temporary file parameter created with insecure permissions  
2177634 - CVE-2023-27904 Jenkins: Information disclosure through error stack traces related to agents

6. Package List:

Red Hat OpenShift Container Platform 4.10:

Source:  
cri-o-1.23.5-8.rhaos4.10.gitcc8441d.el7.src.rpm  
openshift-4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7.src.rpm  
openshift-clients-4.10.0-202304032041.p0.g3a7500d.assembly.stream.el7.src.rpm

x86_64:  
cri-o-1.23.5-8.rhaos4.10.gitcc8441d.el7.x86_64.rpm  
cri-o-debuginfo-1.23.5-8.rhaos4.10.gitcc8441d.el7.x86_64.rpm  
openshift-clients-4.10.0-202304032041.p0.g3a7500d.assembly.stream.el7.x86_64.rpm  
openshift-clients-redistributable-4.10.0-202304032041.p0.g3a7500d.assembly.stream.el7.x86_64.rpm  
openshift-hyperkube-4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7.x86_64.rpm

Red Hat OpenShift Container Platform 4.10:

Source:  
cri-o-1.23.5-8.rhaos4.10.gitcc8441d.el8.src.rpm  
haproxy-2.2.19-4.el8.src.rpm  
jenkins-2-plugins-4.10.1680703106-1.el8.src.rpm  
jenkins-2.387.1.1680701869-1.el8.src.rpm  
kernel-4.18.0-305.85.1.el8_4.src.rpm  
kernel-rt-4.18.0-305.85.1.rt7.157.el8_4.src.rpm  
openshift-4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8.src.rpm  
openshift-clients-4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8.src.rpm  
toolbox-0.0.9-1.rhaos4.10.el8.src.rpm

aarch64:  
bpftool-4.18.0-305.85.1.el8_4.aarch64.rpm  
bpftool-debuginfo-4.18.0-305.85.1.el8_4.aarch64.rpm  
cri-o-1.23.5-8.rhaos4.10.gitcc8441d.el8.aarch64.rpm  
cri-o-debuginfo-1.23.5-8.rhaos4.10.gitcc8441d.el8.aarch64.rpm  
cri-o-debugsource-1.23.5-8.rhaos4.10.gitcc8441d.el8.aarch64.rpm  
haproxy-debugsource-2.2.19-4.el8.aarch64.rpm  
haproxy22-2.2.19-4.el8.aarch64.rpm  
haproxy22-debuginfo-2.2.19-4.el8.aarch64.rpm  
kernel-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-core-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-cross-headers-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-debug-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-debug-core-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-debug-debuginfo-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-debug-devel-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-debug-modules-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-debug-modules-extra-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-debug-modules-internal-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-debuginfo-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-debuginfo-common-aarch64-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-devel-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-headers-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-modules-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-modules-extra-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-modules-internal-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-selftests-internal-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-tools-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-tools-debuginfo-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-tools-libs-4.18.0-305.85.1.el8_4.aarch64.rpm  
kernel-tools-libs-devel-4.18.0-305.85.1.el8_4.aarch64.rpm  
openshift-clients-4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8.aarch64.rpm  
openshift-hyperkube-4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8.aarch64.rpm  
perf-4.18.0-305.85.1.el8_4.aarch64.rpm  
perf-debuginfo-4.18.0-305.85.1.el8_4.aarch64.rpm  
python3-perf-4.18.0-305.85.1.el8_4.aarch64.rpm  
python3-perf-debuginfo-4.18.0-305.85.1.el8_4.aarch64.rpm

noarch:  
jenkins-2-plugins-4.10.1680703106-1.el8.noarch.rpm  
jenkins-2.387.1.1680701869-1.el8.noarch.rpm  
kernel-doc-4.18.0-305.85.1.el8_4.noarch.rpm  
toolbox-0.0.9-1.rhaos4.10.el8.noarch.rpm

ppc64le:  
bpftool-4.18.0-305.85.1.el8_4.ppc64le.rpm  
bpftool-debuginfo-4.18.0-305.85.1.el8_4.ppc64le.rpm  
cri-o-1.23.5-8.rhaos4.10.gitcc8441d.el8.ppc64le.rpm  
cri-o-debuginfo-1.23.5-8.rhaos4.10.gitcc8441d.el8.ppc64le.rpm  
cri-o-debugsource-1.23.5-8.rhaos4.10.gitcc8441d.el8.ppc64le.rpm  
haproxy-debugsource-2.2.19-4.el8.ppc64le.rpm  
haproxy22-2.2.19-4.el8.ppc64le.rpm  
haproxy22-debuginfo-2.2.19-4.el8.ppc64le.rpm  
kernel-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-core-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-cross-headers-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-debug-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-debug-core-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-debug-debuginfo-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-debug-devel-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-debug-modules-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-debug-modules-extra-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-debug-modules-internal-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-debuginfo-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-debuginfo-common-ppc64le-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-devel-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-headers-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-ipaclones-internal-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-modules-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-modules-extra-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-modules-internal-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-selftests-internal-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-tools-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-tools-debuginfo-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-tools-libs-4.18.0-305.85.1.el8_4.ppc64le.rpm  
kernel-tools-libs-devel-4.18.0-305.85.1.el8_4.ppc64le.rpm  
openshift-clients-4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8.ppc64le.rpm  
openshift-hyperkube-4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8.ppc64le.rpm  
perf-4.18.0-305.85.1.el8_4.ppc64le.rpm  
perf-debuginfo-4.18.0-305.85.1.el8_4.ppc64le.rpm  
python3-perf-4.18.0-305.85.1.el8_4.ppc64le.rpm  
python3-perf-debuginfo-4.18.0-305.85.1.el8_4.ppc64le.rpm

s390x:  
bpftool-4.18.0-305.85.1.el8_4.s390x.rpm  
bpftool-debuginfo-4.18.0-305.85.1.el8_4.s390x.rpm  
cri-o-1.23.5-8.rhaos4.10.gitcc8441d.el8.s390x.rpm  
cri-o-debuginfo-1.23.5-8.rhaos4.10.gitcc8441d.el8.s390x.rpm  
cri-o-debugsource-1.23.5-8.rhaos4.10.gitcc8441d.el8.s390x.rpm  
haproxy-debugsource-2.2.19-4.el8.s390x.rpm  
haproxy22-2.2.19-4.el8.s390x.rpm  
haproxy22-debuginfo-2.2.19-4.el8.s390x.rpm  
kernel-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-core-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-cross-headers-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-debug-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-debug-core-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-debug-debuginfo-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-debug-devel-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-debug-modules-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-debug-modules-extra-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-debug-modules-internal-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-debuginfo-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-debuginfo-common-s390x-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-devel-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-headers-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-modules-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-modules-extra-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-modules-internal-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-selftests-internal-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-tools-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-tools-debuginfo-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-zfcpdump-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-zfcpdump-core-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-zfcpdump-debuginfo-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-zfcpdump-devel-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-zfcpdump-modules-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-zfcpdump-modules-extra-4.18.0-305.85.1.el8_4.s390x.rpm  
kernel-zfcpdump-modules-internal-4.18.0-305.85.1.el8_4.s390x.rpm  
openshift-clients-4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8.s390x.rpm  
openshift-hyperkube-4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8.s390x.rpm  
perf-4.18.0-305.85.1.el8_4.s390x.rpm  
perf-debuginfo-4.18.0-305.85.1.el8_4.s390x.rpm  
python3-perf-4.18.0-305.85.1.el8_4.s390x.rpm  
python3-perf-debuginfo-4.18.0-305.85.1.el8_4.s390x.rpm

x86_64:  
bpftool-4.18.0-305.85.1.el8_4.x86_64.rpm  
bpftool-debuginfo-4.18.0-305.85.1.el8_4.x86_64.rpm  
cri-o-1.23.5-8.rhaos4.10.gitcc8441d.el8.x86_64.rpm  
cri-o-debuginfo-1.23.5-8.rhaos4.10.gitcc8441d.el8.x86_64.rpm  
cri-o-debugsource-1.23.5-8.rhaos4.10.gitcc8441d.el8.x86_64.rpm  
haproxy-debugsource-2.2.19-4.el8.x86_64.rpm  
haproxy22-2.2.19-4.el8.x86_64.rpm  
haproxy22-debuginfo-2.2.19-4.el8.x86_64.rpm  
kernel-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-core-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-cross-headers-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-debug-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-debug-core-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-debug-debuginfo-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-debug-devel-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-debug-modules-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-debug-modules-extra-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-debug-modules-internal-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-debuginfo-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-debuginfo-common-x86_64-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-devel-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-headers-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-ipaclones-internal-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-modules-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-modules-extra-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-modules-internal-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-rt-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-core-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debug-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debug-core-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debug-debuginfo-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debug-devel-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debug-kvm-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debug-modules-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debug-modules-extra-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debug-modules-internal-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debuginfo-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-debuginfo-common-x86_64-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-devel-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-kvm-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-modules-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-modules-extra-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-modules-internal-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-rt-selftests-internal-4.18.0-305.85.1.rt7.157.el8_4.x86_64.rpm  
kernel-selftests-internal-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-tools-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-tools-debuginfo-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-tools-libs-4.18.0-305.85.1.el8_4.x86_64.rpm  
kernel-tools-libs-devel-4.18.0-305.85.1.el8_4.x86_64.rpm  
openshift-clients-4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8.x86_64.rpm  
openshift-clients-redistributable-4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8.x86_64.rpm  
openshift-hyperkube-4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8.x86_64.rpm  
perf-4.18.0-305.85.1.el8_4.x86_64.rpm  
perf-debuginfo-4.18.0-305.85.1.el8_4.x86_64.rpm  
python3-perf-4.18.0-305.85.1.el8_4.x86_64.rpm  
python3-perf-debuginfo-4.18.0-305.85.1.el8_4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-3172  
https://access.redhat.com/security/cve/CVE-2022-31690  
https://access.redhat.com/security/cve/CVE-2022-31692  
https://access.redhat.com/security/cve/CVE-2022-42889  
https://access.redhat.com/security/cve/CVE-2023-24422  
https://access.redhat.com/security/cve/CVE-2023-27898  
https://access.redhat.com/security/cve/CVE-2023-27899  
https://access.redhat.com/security/cve/CVE-2023-27903  
https://access.redhat.com/security/cve/CVE-2023-27904  
https://access.redhat.com/security/updates/classification/#critical  
https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZDbdMtzjgjWX9erEAQjYThAAhqisQ9b44x+9/wyDxxvk76uR2NaZPzNo  
kabifxq1PnMHASvaD1UwOa9SlMTUSE0WOK0TKSQeLmpPWVSMtbTwg7TQ4ITBCKg3  
ci3YZUGUfd8kitT8m+YFabRdjjEvp4zquA7jGHAiyeVNxUqVSCm+3Xu/qnTJBZU+  
Lg+ZSHOIGXoAMwrK5tcrjNdWLcXRHwhTx+yTEtI78zT8gOR1SwKeiBeo9PZejwvI  
hpzS60Lf2RRvgE1XYpW1QGk27FDEqnKZQwq/xA8VmEFvv5PUn2a/HuzPV6+TE+go  
yw3hwZj+NdeVu0tEuPn/nwdybc74LfSN3oQOsJ+IxDHl8wRECe/Ki4db1NlwPCOR  
v33fnObzojt8wMSobA63X8smklQTT3h4C5OjG3QH3R7uLv2hUIlrRqBW1+frzMMi  
hN7DMt7DCMdSn8a5keKd2apsIHvtzFQLeZDS49fcqkIDEGSmPs/bXHWnRTjlrown  
PqJayWgk0LpZcyqxV/K/y4fdCm/+skaY1bX6GLpvMEd29z8LT3R/E3N/HqMHEZO7  
DJ/YGc2cxtOBMq5uaLUDIFhcvTUCU46zh+1H8XRlSm4nTFIX0p7tvTCDPVuGvaYv  
eAHIdGls6f9obPkOTaLkdN0UCtUDnhT5nSSbL7NH/Tw+rgR/U/idXyuZUt1XrnO8  
rcrquYe48D0=  
=Ywi7  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Tag

#kubernetes