Red Hat Security Advisory: OpenShift Container Platform 4.7.48 packages and security update
Red Hat OpenShift Container Platform release 4.7.48 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. CVE-2022-25173 CVE-2022-25174 CVE-2022-25175 CVE-2022-25181 CVE-2022-25182 CVE-2022-25183 CVE-2022-25176 CVE-2022-25177 CVE-2022-25178 CVE-2022-25179 CVE-2022-25180 CVE-2022-25184"
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-25184US | medium6.5 | — | ||
Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing atta… | ||||
| CVE-2022-25183US | high8.8 | — | ||
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing a… | ||||
| CVE-2022-25182US | high8.8 | — | ||
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrar… | ||||
| CVE-2022-25181US | high8.8 | — | ||
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrar… | ||||
| CVE-2022-25180US | medium4.3OT elevated | — | ||
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permissio… | ||||
| CVE-2022-25179US | medium6.5 | — | ||
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files u… | ||||
| CVE-2022-25178US | medium6.5 | — | ||
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able… | ||||
| CVE-2022-25177US | medium6.5 | — | ||
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using… | ||||
| CVE-2022-25176US | medium6.5 | — | ||
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script… | ||||
| CVE-2022-25175US | high8.8 | Exploit | ||
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Confi… | ||||
| CVE-2022-25174US | high8.8 | Exploit | ||
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with… | ||||
| CVE-2022-25173US | high8.8 | Exploit | ||
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelin… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2022:1248self
- https://access.redhat.com/security/updates/classification/#importantexternal
- 2055719external
- 2055733external
- 2055734external
- 2055787external
- 2055788external
- 2055789external
remediations (24)
- Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248 - Fixedjenkins-2-plugins-0:4.7.1648800585-1.el8.src as a component of Red Hat OpenShift Container Platform 4.7
For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:1248
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan