Product:

Openshift_container_platform

(Redhat)
Repositories • https://github.com/FasterXML/jackson-databind
• https://github.com/torvalds/linux
• https://github.com/Perl/perl5
• https://github.com/evanphx/json-patch
• https://github.com/ansible/ansible
#Vulnerabilities 234
Date Id Summary Products Score Patch Annotated
2019-04-10 CVE-2019-1003049 Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches. Jenkins, Communications_cloud_native_core_automated_test_suite, Openshift_container_platform 8.1
2019-04-10 CVE-2019-1003050 The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names. Jenkins, Communications_cloud_native_core_automated_test_suite, Openshift_container_platform 5.4
2019-07-17 CVE-2019-10354 A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information. Jenkins, Openshift_container_platform 4.3
2019-07-31 CVE-2019-10355 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts. Script_security, Openshift_container_platform 8.8
2019-07-31 CVE-2019-10356 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts. Script_security, Openshift_container_platform 8.8
2019-07-31 CVE-2019-10357 A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries. Pipeline\:shared_groovy_libraries, Openshift_container_platform 4.3
2019-08-28 CVE-2019-10384 Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user. Jenkins, Communications_cloud_native_core_automated_test_suite, Openshift_container_platform 8.8
2019-08-28 CVE-2019-10383 A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages. Jenkins, Communications_cloud_native_core_automated_test_suite, Openshift_container_platform 4.8
2020-12-15 CVE-2020-27777 A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel. Linux_kernel, Enterprise_linux, Openshift_container_platform 6.7
2018-01-22 CVE-2018-5968 FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist. Debian_linux, Jackson\-Databind, E\-Series_santricity_os_controller, E\-Series_santricity_web_services_proxy, Oncommand_shift, Jboss_enterprise_application_platform, Openshift_container_platform, Virtualization, Virtualization_host 8.1