RHBA-2020:2409
Vulnerability from csaf_redhat - Published: 2020-07-13 17:10 - Updated: 2026-11-01 10:38Summary
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.5 image release advisory
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.5.1 is now available with
updates to packages and images that fix several bugs and add enhancements.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat
OpenShift Container Platform 4.5.1. See the following advisory for the
RPM packages for this release:
https://access.redhat.com/errata/RHBA-2020:2408
Space precludes documenting all of the bug fixes and enhancements in this
advisory, as well as all of the container images in this advisory. See the
following Release Notes documentation, which will be updated shortly for
this release, for details about these changes:
https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html
You may download the oc tool and use it to inspect release image metadata as follows:
$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.5.1-x86_64
The image digest is sha256:a656048696e79a30f0536f5acd5a1e8ec5ae331d4c7d21ca62bc8de412c79dc4
All OpenShift Container Platform 4.5 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster
-between-minor.html#understanding-upgrade-channels_updating-cluster-between
-minor.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A sandbox bypass flaw was found in the Jenkins Script Security Plugin versions 1.67 and earlier, that are related to the handling of closure default parameter expressions. This flaw allows attackers to execute arbitrary code in sandboxed scripts.
8.8 (High)
Affected products
Fixed
77 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-aws-machine-controllers@sha256:7d29cf4dc690bfee58b9247bc7e67210ce9634139b15ce2bd56fbe905b246c83_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-azure-machine-controllers@sha256:edb3b90da9ff0fa55dd878d7660fc0846df22dbd0e85708e3131430f051bed89_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-baremetal-machine-controllers@sha256:a8df2fab0063f0b6367fad4e7d85d7b702d826677a3291cf24b7b749943c501c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cli-artifacts@sha256:af06b5e2150f08dcc1904500e05d3aa730baf50d9888d7637b86fb0ef43ef159_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cli@sha256:b93a3f13057991466caf3ba6517493015299a856c6b752bd49b7d4c294312177_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cloud-credential-operator@sha256:7768af870ecb251e6c74ca6298ece3e7ea11fb154565cf41bca137061927c58d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-authentication-operator@sha256:6200da75e6b80fab637c2dc765f69c8ba40aa5dfb42d20610b913651136e03ba_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-autoscaler-operator@sha256:dc1ad750397273b169ecfe68baac4e42db0333908057a31c48217677bfca87c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-autoscaler@sha256:a892fb19168f68a35912a7c67d1b0d41e487fadb120fa8cd4317ae95b23298c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-bootstrap@sha256:05416a5c4c45177233753e4912f3dfc6f3d6bca47455286cd4d08769825083d4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-config-operator@sha256:b8ba4b92f04d9e4ff57516e6f70ebcf5bafe0a51c888062ab405f32c7381eedd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-dns-operator@sha256:eea7d89790cf1c9eb9e22cc4a247a674f0721fededdc905d4c533ff57974dacb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-image-registry-operator@sha256:a2912743f134109d5e0aece49db6d59e20aa8878142dc9de818e23deed707f38_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-ingress-operator@sha256:4a5256cdb4689b6358a21bcf970a024de307554a43a4a34027fba7ec8768d21c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-kube-apiserver-operator@sha256:414aed0e6aace1a47945e9de709f3e16c96ec80275775f0c08d22425569bce56_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-kube-controller-manager-operator@sha256:759afff8ce10e2224c2a41272a3da78c782c294d0cc2624d63c4e466de597913_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-kube-scheduler-operator@sha256:b09d76b13ee2c6a766098483d6a4abe0946178dddb9c3b65b27ccd7be8fe7bd3_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-monitoring-operator@sha256:434ce55c0306215fc3067f1565f9f14cb60be8cdffc30dd54ff86d35c41a6418_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-network-operator@sha256:e9aea1c7c70b70257f10cb34f359162fcbd8007615e5fea5eb5935b2781e3c14_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-node-tuning-operator@sha256:5c3ece498eaf33fec8c616437763ad64e8ec278f9bab368b86a9525885420994_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-openshift-apiserver-operator@sha256:1f075c767d06eac44cf477aadb7ca0421af4778ca0b20885cc1eb071101d073a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-openshift-controller-manager-operator@sha256:acc93fac7bf822a5d77cb1c640d899bad35c7106923ec0fd715858beb6c92ef6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-samples-operator@sha256:3730e93274a5a0350e222dfc161bc4f5fb97e53e0672ec907888bceda4abb89b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-storage-operator@sha256:f2a634b4207229b14da873dcd9c5a36f79701c2d410cee55bcdd46e8f7e7dca6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-svcat-apiserver-operator@sha256:d6de058aca970acbff2530afd8f617a06200cf65cac4775b3219fc33b1a47842_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-update-keys@sha256:db0f41b3e4ea84a200135a2c810fe60ce0b9e35efff50249914381b76c56050f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-version-operator@sha256:9c4a22bed1c7ef3847cf66d83349295dd6dcf402673c115d2957d56909b38c6e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-configmap-reloader@sha256:8e18c6d3dca4ff8c6c7bc60ee5ac2a41d153c0567f58ec1ca71200e742eff635_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-console-operator@sha256:348b6648639f79f3ae83aa5441d1c1934974df0d4a0bea3d1dc035c2b85b4ec4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-coredns@sha256:c09633512a460fda547cd079565554ab79cbfbe767c827bba075f05b47e71d4a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-csi-snapshot-controller-rhel7@sha256:6b60f5ebcde8004328d625755e6e92cbae2088cc3b9ebf4bd6c1f777d74d443b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-csi-snapshot-controller@sha256:6b60f5ebcde8004328d625755e6e92cbae2088cc3b9ebf4bd6c1f777d74d443b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-deployer@sha256:ba1c6776795c8f5582c09b223e5a841072db04a4eabf50e37486a3b38494a6e7_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-docker-builder@sha256:80cff3e2e21f61b46427c2a19cfe73acebbfcbf3cb81472bbd27a130aa342008_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-docker-registry@sha256:e4d1770f3b5bb587190addd0142d5cbd43c8e42176ad30fe31026e664cdb9c15_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-etcd@sha256:3d1b91f3a84984f9af4aad043067e1ea4f3d29ffae658d697881d63eb6ba6c45_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-grafana@sha256:b5d67fff6f95f2cba61d52160cc94986d3c0052fc2c1c2ff12b9856e9a6ef582_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-haproxy-router@sha256:c54a192b3c745fd42ec9a27ddf87c7ec4d4fbb10e9d66c911a77222e51269a3f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-installer-artifacts@sha256:f61065181fbe904b228012469931d74bfedc3948187a4105b24309bf7be2dfee_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-installer@sha256:3f06afe1b95a2b67cf27df53fd34d2033630c9859ef057d0a5c9108bb3511310_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-jenkins-agent-maven@sha256:d2221f5c4c9c9fcdccd9b83d618187ba1849a1b3b23a0b2d7611fc40e66d53a6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-jenkins@sha256:b0d60ec09df1803367f5c0b2853b9636fbe9712ca9870038b81f96b75dfdf394_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-k8s-prometheus-adapter@sha256:b5c98667650a56832b1c770dfe6206eda3656c8c1731c6e1d2ce73eb7a86a7d8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-keepalived-ipfailover@sha256:907b54fb7e895faacb5f29c9352f881d9b3cd320c8eaf3210a8e653e5e4b9c02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-kube-proxy@sha256:eec3b2bd47bfb05ce0b8cad95a6211dbe56a66ceb6e8e6f185e6a11202c05010_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-kube-rbac-proxy@sha256:0b9be905dc8404760427a4bfbb9274545b2fb03774d85cd8ee5d93f847c69293_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-kube-state-metrics@sha256:f8d81f41a807922fe01dcc21622cdd50bf714314d67df98f47bf1f999c56044b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-libvirt-machine-controllers@sha256:b8d41c4f550a6f3e4ecc8b9a3f7df066b4f3168176e2c91452e609683b2ba1b7_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-local-storage-static-provisioner@sha256:5f25b595aa6e41b30037b5fc58de97247fa05435e119a41e2f0623f2369ba455_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-machine-api-operator@sha256:727cb612991532c21be9387e623c59285bec6873bb5f0aae0067817b08cdbc53_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:3b00b0a8669732e58d75c2f86740e5ba5631bcf9028d32e2577180ad7dd6f7d7_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-multus-admission-controller@sha256:af5204db131e25b79d9c0596c9a999761a6e5ef8a067f5642a74e1c419ca8ec5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-must-gather@sha256:db464f9453800beb0a9744e4d4320e77e1e0ac6da6399f0081ee2e555171c83a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-proxy@sha256:6e0f2d6b698a8b94b393771578bf69c3fab53601f90c626c9c0c3c3f10edf38a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-openstack-machine-controllers@sha256:32661ef48fd967e0c0502236f65634109eb0e33824133da28a21882ae9117719_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-operator-lifecycle-manager@sha256:4c5f71989fa5e9a8644f4d9d6216f0a7aa2609dfd214f10dc348b9e6be10ce7f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-operator-marketplace@sha256:643978bd7cfc6056aad9c0c8be01962987d85324ff3275a6baa1263a1a4bcf26_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-operator-registry@sha256:30fdaeb10ae82e2df561588445bcd7cde2d12f0f5417f0917f5a54fa8775b669_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-ovn-kubernetes@sha256:8f3c2711b2f0e762862981c97143e2871b39af1bcde90fdbd5d7147b4a91b764_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-pod@sha256:31c741273dd860142938ac334db3512c9ea21cd1b4b08f454ce7af54d3850b1d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-prom-label-proxy@sha256:70e7f50dc92bf83913d318f2ef829981a1c0570db21a9cc7ccda8e3e44adbb09_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-prometheus-alertmanager@sha256:8e266dbca9bcbd9e211dcba2aeb3a6acdb557acf740476371256fb1e11e20a89_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-prometheus-config-reloader@sha256:6ece509e6f05f05f3a7960121c1940c1fccdbd9ce89e1800d3662c1ebc4b3eed_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-prometheus-node-exporter@sha256:d56867001a64908c78affa9c20b0d70cc40f05184c66576fbe89d7c95a82164a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-prometheus-operator@sha256:545a6ed6d1d02a7abd73919308d5cd0880b9aa5272bd4a5c0fbf552f51e7d5a3_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-prometheus@sha256:78e5a4e0d5598292daac4ddd171644b51845dc292904be6135650e510c353ba2_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-service-ca-operator@sha256:a1eb966503a8bfa354ccae0b2ff576655e15396be6ef90aed3564055ff2a1f47_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-telemeter@sha256:666b5e7662fd6ae25fbcd59f88127ed020a444556ba84dc0f5e21095416181a3_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.5:openshift4/ose-tests@sha256:ddbb4cab4e79a2e6cc9242c73a7b41076d8dcf02e0d6116ab894063355db066b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.5:openshift4/ose-ironic-hardware-inventory-recorder-rhel8@sha256:6d5b5dbb035da55f94e02486e8e27aa3764407c34975d9030f4fdf91f4598ba1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.5:openshift4/ose-ironic-inspector-rhel8@sha256:8e6450e52e177db9902b67c023ec1614d775d514572d41253ec2c0cbefb25186_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.5:openshift4/ose-ironic-ipa-downloader-rhel8@sha256:f5f3c1ca779928e7ae489a449e05cf7961bda869e48836b5597418f83028c0bc_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.5:openshift4/ose-ironic-machine-os-downloader-rhel8@sha256:24b0c39b8325b04383ce1970259939bd28b8f576f9b12e515e14904016a498e0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.5:openshift4/ose-ironic-rhel8@sha256:c2e75a25b001f5a52e264f02f4ec6cb484fa2812b48b549715d7dfe209a51e0c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.5:openshift4/ose-ironic-static-ip-manager-rhel8@sha256:7de40dbdee286016afaea439a6405f473db3ea2009c1ea7c2e001fcf1fbea452_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.5:openshift4/ose-kuryr-cni-rhel8@sha256:460987b2aa3a491b66b06b2b6b66bf242dcc78dae63011f645292d995d32f097_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.5:openshift4/ose-kuryr-controller-rhel8@sha256:93b06fb4281d1b6bbb5d2a1064d8470db65b4693262d4e42447ba39a5e71ec89_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Jenkins. Encryption key parameters are improperly reused in the Inbound TCP Agent Protocol/3 allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents. The highest threat from this vulnerability is to data confidentiality.
8.6 (High)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Important
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.
5.8 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Moderate
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.
5.3 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Moderate
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.
5.3 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Moderate
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
4.4 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Moderate
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.
4.3 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Low
REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.
CWE-1021 - Improper Restriction of Rendered UI Layers or FramesAffected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Low
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
8.8 (High)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Important
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
8.8 (High)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Important
Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.
5.4 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Moderate
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies.
8.8 (High)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Important
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.
8.8 (High)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Important
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
5.4 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Moderate
A denial of service flaw was found in Kubernetes' Kubelet API. A remote attacker can exploit this flaw by sending repeated, crafted HTTP requests to exhaust available memory and cause a crash.
4.3 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Moderate
A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master's host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).
6.3 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Moderate
A use-after-free vulnerability was found in the Go GPGME wrapper library, github.com/proglottis/gpgme. An attacker could use this flaw to crash or cause potential code execution in Go applications that use this library, under certain conditions, during GPG signature verification.
7.5 (High)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Moderate
A denial of service vulnerability was found in the SSH package of the golang.org/x/crypto library. An attacker could exploit this flaw by supplying crafted SSH ed25519 keys to cause a crash in applications that use this package as either an SSH client or server.
5.3 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Low
A flaw was found in OpenShift Container Platform versions from 4.1 to 4.4 inclusive. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity.
7.0 (High)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Important
A vulnerability was found in affected container networking implementations that allow malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending “rogue” IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
6.0 (Medium)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Low
A flaw was found in the way HAProxy processed certain HTTP/2 request packets. This flaw allows an attacker to send crafted HTTP/2 request packets, which cause memory corruption, leading to a crash or potential remote arbitrary code execution with the permissions of the user running HAProxy.
8.8 (High)
Affected products
Fixed
77 products, the same list as for
CVE-2019-16538
Threats
Impact
Low
References
1998 references
Loading 1.2 MB of JSON…
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.