Red Hat OpenShift Container Platform 3 update for jenkins-2-plugins



Published: 2020-11-17
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2020-2252
CVE-2020-2254
CVE-2020-2255
CWE-ID CWE-295
CWE-22
CWE-264
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
jenkins-2-plugins (Red Hat package)
Operating systems & Components / Operating system package or component

Red Hat OpenShift Container Platform
Client/Desktop applications / Software for system administration

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Improper Certificate Validation

EUVDB-ID: #VU46877

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2252

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a man-in-the-middle (MitM) attack.

The vulnerability exists due to the affected plugin does not perform hostname validation when connecting to the configured SMTP server. A remote attacker can perform a MitM attack and intercept these connections.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jenkins-2-plugins (Red Hat package): 3.11.1535566135-1.el7 - 3.11.1593081747-1.el7

Red Hat OpenShift Container Platform: 3.11.0

External links

http://access.redhat.com/errata/RHSA-2020:5102


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Path traversal

EUVDB-ID: #VU46880

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2254

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to the affected plugin provides an undocumented feature flag, "blueocean.features.GIT_READ_SAVE_TYPE", that when set to the value "clone". A remote authenticated attacker with Item/Configure or Item/Create permission can send a specially crafted HTTP request and read arbitrary files on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jenkins-2-plugins (Red Hat package): 3.11.1535566135-1.el7 - 3.11.1593081747-1.el7

Red Hat OpenShift Container Platform: 3.11.0

External links

http://access.redhat.com/errata/RHSA-2020:5102


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU46881

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2255

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the affected plugin does not perform permission checks in several HTTP endpoints implementing connection tests. A remote user with Overall/Read permission can connect to an attacker-specified URL.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jenkins-2-plugins (Red Hat package): 3.11.1535566135-1.el7 - 3.11.1593081747-1.el7

Red Hat OpenShift Container Platform: 3.11.0

External links

http://access.redhat.com/errata/RHSA-2020:5102


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###