SB2022050424 - Multiple vulnerabilities in OpenShift Container Platform 4.6
Published: May 4, 2022 Updated: November 13, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 27 secuirty vulnerabilities.
1) OS Command Injection (CVE-ID: CVE-2022-25175)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to the affected plugin uses distinct checkout directories per SCM for the readTrusted step. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Integer overflow (CVE-ID: CVE-2022-25315)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in storeRawNames function. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Input validation error (CVE-ID: CVE-2022-25236)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper protection against insertion of namesep characters into namespace URIs in xmlparse.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
4) Code Injection (CVE-ID: CVE-2022-25235)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the affected application lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Information disclosure (CVE-ID: CVE-2022-25184)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected plugin reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator. A remote user can gain unauthorized access to sensitive information on the system.
6) Code Injection (CVE-ID: CVE-2022-25183)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the affected plugin uses the names of Pipeline libraries to create cache directories without any sanitization. A remote user can use specially crafted library names and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Code Injection (CVE-ID: CVE-2022-25182)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the affected plugin uses the names of Pipeline libraries to create directories without canonicalization or sanitization. A remote user can use specially crafted library names and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
8) Code Injection (CVE-ID: CVE-2022-25181)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the affected plugin uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration. A remote user can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
9) Information disclosure (CVE-ID: CVE-2022-25180)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected plugin includes password parameters from the original build in replayed builds. A remote user can gain unauthorized access to sensitive information on the system.
10) UNIX symbolic link following (CVE-ID: CVE-2022-25179)
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to the affected plugin follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step. A remote user can configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
11) UNIX symbolic link following (CVE-ID: CVE-2022-25178)
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to the affected plugin does not restrict the names of resources passed to the "libraryResource" step. A remote user can create a specially crafted symbolic link to a critical file on the system and read arbitrary files on the Jenkins controller file system.
12) UNIX symbolic link following (CVE-ID: CVE-2022-25177)
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to the affected plugin follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step. A remote user can create a specially crafted symbolic link to a critical file on the system and read arbitrary files on the Jenkins controller file system.
13) UNIX symbolic link following (CVE-ID: CVE-2022-25176)
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to the affected plugin follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines. A remote user can create a specially crafted symbolic link to a critical file on the system and gain access to sensitive information.
14) OS Command Injection (CVE-ID: CVE-2022-25174)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to the affected plugin uses the same checkout directories for distinct SCMs for Pipeline libraries. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
15) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-24769)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to containers are incorrectly started with non-empty inheritable Linux process capabilities, which leads to security restrictions bypass and privilege escalation.
16) OS Command Injection (CVE-ID: CVE-2022-25173)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to the affected plugin uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
17) SQL injection (CVE-ID: CVE-2022-24407)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of password in the SQL plugin shipped with Cyrus SASL. A remote non-authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
18) Improper input validation (CVE-ID: CVE-2022-21496)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the JNDI component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
19) Improper input validation (CVE-ID: CVE-2022-21476)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
20) Improper input validation (CVE-ID: CVE-2022-21443)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
21) Improper input validation (CVE-ID: CVE-2022-21434)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
22) Improper input validation (CVE-ID: CVE-2022-21426)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the JAXP component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
23) Infinite loop (CVE-ID: CVE-2022-0778)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop within the BN_mod_sqrt() function when processing an ASN.1 certificate that contains elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. A remote attacker can supply a specially crafted certificate to the TLS server or client, consume all available system resources and cause denial of service conditions.
24) Infinite loop (CVE-ID: CVE-2022-0711)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when processing HTTP responses containing the "Set-Cookie2" header. A remote attacker can send a specially crafted HTTP request to the server, consume all available system resources and cause denial of service conditions.
25) Stack-based buffer overflow (CVE-ID: CVE-2022-0435)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the Linux kernel networking module for the Transparent Inter-Process Communication (TIPC) protocol. A remote unauthenticated attacker can send specially crafted traffic to the system, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the TIPC bearer is set up.
26) Use-after-free (CVE-ID: CVE-2020-8649)
The vulnerability allows a local authenticated user to #BASIC_IMPACT#.
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.
27) Use-after-free (CVE-ID: CVE-2020-8647)
The vulnerability allows a local authenticated user to #BASIC_IMPACT#.
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.
Remediation
Install update from vendor's website.