OpenShift Container Platform 4.4.18 packages update

1) Stored cross-site scripting

EUVDB-ID: #VU30126

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2220

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in job build time trend. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

machine-config-daemon (Red Hat package): 4.4.0-202006080017.git.1.32e0736.el8 - 4.4.0-202007092124.p0.git.2349.08d34d1.el8

openshift-kuryr (Red Hat package): 4.4.0-202006080017.git.1.855ef1d.el8

cri-o (Red Hat package): 1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7 - 1.17.4-14.dev.rhaos4.4.gitb93af5d.el8

container-selinux (Red Hat package): 2.124.0-1.el8

jenkins (Red Hat package): before 2.235.2.1597312065-1.el7

CPE2.3

External links

https://access.redhat.com/errata/RHBA-2020:3441

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stored cross-site scripting

EUVDB-ID: #VU30127

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2221

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the upstream job’s display name. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

machine-config-daemon (Red Hat package): 4.4.0-202006080017.git.1.32e0736.el8 - 4.4.0-202007092124.p0.git.2349.08d34d1.el8

openshift-kuryr (Red Hat package): 4.4.0-202006080017.git.1.855ef1d.el8

cri-o (Red Hat package): 1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7 - 1.17.4-14.dev.rhaos4.4.gitb93af5d.el8

container-selinux (Red Hat package): 2.124.0-1.el8

jenkins (Red Hat package): before 2.235.2.1597312065-1.el7

CPE2.3

External links

https://access.redhat.com/errata/RHBA-2020:3441

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Stored cross-site scripting

EUVDB-ID: #VU30128

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2222

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in job name in the "Keep this build forever" badge tooltip. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

machine-config-daemon (Red Hat package): 4.4.0-202006080017.git.1.32e0736.el8 - 4.4.0-202007092124.p0.git.2349.08d34d1.el8

openshift-kuryr (Red Hat package): 4.4.0-202006080017.git.1.855ef1d.el8

cri-o (Red Hat package): 1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7 - 1.17.4-14.dev.rhaos4.4.gitb93af5d.el8

container-selinux (Red Hat package): 2.124.0-1.el8

jenkins (Red Hat package): before 2.235.2.1597312065-1.el7

CPE2.3

External links

https://access.redhat.com/errata/RHBA-2020:3441

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Stored cross-site scripting

EUVDB-ID: #VU30129

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2223

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to the affected software does not escape the "href" attribute of links to downstream jobs displayed in the build console page. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

machine-config-daemon (Red Hat package): 4.4.0-202006080017.git.1.32e0736.el8 - 4.4.0-202007092124.p0.git.2349.08d34d1.el8

openshift-kuryr (Red Hat package): 4.4.0-202006080017.git.1.855ef1d.el8

cri-o (Red Hat package): 1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7 - 1.17.4-14.dev.rhaos4.4.gitb93af5d.el8

container-selinux (Red Hat package): 2.124.0-1.el8

jenkins (Red Hat package): before 2.235.2.1597312065-1.el7

CPE2.3

External links

https://access.redhat.com/errata/RHBA-2020:3441

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Low
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2020-2220 CVE-2020-2221 CVE-2020-2222 CVE-2020-2223
CWE-ID	CWE-79
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	machine-config-daemon (Red Hat package) Operating systems & Components / Operating system package or component openshift-kuryr (Red Hat package) Operating systems & Components / Operating system package or component cri-o (Red Hat package) Operating systems & Components / Operating system package or component container-selinux (Red Hat package) Operating systems & Components / Operating system package or component jenkins (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.