Cross-site scripting in Credentials - CVE-2021-21648

Vulnerability identifier: #VU53152

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2021-21648

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Credentials
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
toolbox (Red Hat package)
coreos-installer (Red Hat package)
python-openshift (Red Hat package)
butane (Red Hat package)
python-pyrsistent (Red Hat package)
console-login-helper-messages (Red Hat package)
python-eventlet (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
runc (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
rteval-loads (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
kata-containers (Red Hat package)
python-debtcollector (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
haproxy (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
ignition (Red Hat package)
openvswitch2.15 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-oslo-context (Red Hat package)
python-jsonschema (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-ironic-lib (Red Hat package)
python-oslo-utils (Red Hat package)
openshift-kuryr (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
rust-afterburn (Red Hat package)
python-oslo-i18n (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-db (Red Hat package)
python-oslo-config (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-kubernetes (Red Hat package)
openstack-ironic (Red Hat package)
ovn2.13 (Red Hat package)
redhat-release-coreos (Red Hat package)
ostree (Red Hat package)
ironic-images (Red Hat package)

Install updates from vendor's website.

Credentials - update to 2.3.19
Red Hat OpenShift Container Platform - addressed in versions 4.8.2, 4.10.30
toolbox (Red Hat package) - update to 0.0.8-3.rhaos4.8.el8
coreos-installer (Red Hat package) - update to 0.9.0-6.rhaos4.8.el8
python-openshift (Red Hat package) - update to 0.12.1-1.el8
butane (Red Hat package) - update to 0.12.1-1.rhaos4.8.el8
python-pyrsistent (Red Hat package) - update to 0.16.0-3.el8ost
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.8.el8
python-eventlet (Red Hat package) - update to 0.25.2-4.el8
python-hardware (Red Hat package) - update to 0.27.0-0.20210406121246.756fedb.el8
python-openstacksdk (Red Hat package) - update to 0.53.0-0.20210325011601.4629245.el8
runc (Red Hat package) - addressed in versions 1.0.0-98.rhaos4.8.gitcd80260.el7, 1.0.0-98.rhaos4.8.gitcd80260.el8
python-oslo-upgradecheck (Red Hat package) - update to 1.3.0-0.20210325003851.9f95a6e.el8
rteval-loads (Red Hat package) - update to 1.4-12.el8
Migration Toolkit for Containers - update to 1.5.1
cri-tools (Red Hat package) - addressed in versions 1.21.0-2.el7, 1.21.0-2.el8
cri-o (Red Hat package) - addressed in versions 1.21.2-5.rhaos4.8.gitb27d974.el7, 1.21.2-5.rhaos4.8.gitb27d974.el8
python-sushy-oem-idrac (Red Hat package) - update to 2.0.1-0.20210326152858.83b7eb0.el8
kata-containers (Red Hat package) - update to 2.1.0-4.el8
python-debtcollector (Red Hat package) - update to 2.2.0-0.20210324220630.649189d.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 2.2.1-0.20210325143713.70e39c8.el8
haproxy (Red Hat package) - addressed in versions 2.2.13-1.el7, 2.2.13-1.el8
python-oslo-service (Red Hat package) - update to 2.5.0-0.20210325014731.d25e454.el8
python-tooz (Red Hat package) - update to 2.8.0-0.20210324235001.54448e9.el8
ignition (Red Hat package) - update to 2.9.0-6.rhaos4.8.el8
openvswitch2.15 (Red Hat package) - update to 2.15.0-9.el8fdp
jenkins (Red Hat package) - update to 2.289.1.1624020353-1.el8
podman (Red Hat package) - update to 3.0.1-6.el8
python-oslo-context (Red Hat package) - update to 3.2.0-0.20210325043103.0d02866.el8
python-jsonschema (Red Hat package) - update to 3.2.0-5.el8ost
python-stevedore (Red Hat package) - update to 3.3.0-0.20210325001012.7d7154f.el8
python-oslo-policy (Red Hat package) - update to 3.7.0-0.20210325051823.d853485.el8
python-sushy (Red Hat package) - update to 3.7.1-0.20210428165244.bc49878.el8
python-oslo-serialization (Red Hat package) - update to 4.1.0-0.20210325012242.8445e61.el8
python-keystoneauth1 (Red Hat package) - update to 4.3.0-0.20210325001456.6a66271.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.0-0.20210325004915.7dcf9e9.el8
python-oslo-log (Red Hat package) - update to 4.4.0-0.20210409081224.9b29c90.el8
python-ironic-lib (Red Hat package) - update to 4.6.2-0.20210608101214.ca2e4ba.el8
python-oslo-utils (Red Hat package) - update to 4.8.0-0.20210325043201.3288539.el8
openshift-kuryr (Red Hat package) - update to 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8
openshift-ansible (Red Hat package) - update to 4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7
openshift-clients (Red Hat package) - addressed in versions 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7, 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.8.1624022417-1.el8
rust-afterburn (Red Hat package) - update to 5.0.0-1.rhaos4.8.el8
python-oslo-i18n (Red Hat package) - update to 5.0.1-0.20210324221600.73187bd.el8
openstack-ironic-python-agent (Red Hat package) - update to 7.0.2-0.20210611153100.bfa97cb.el8
python-oslo-db (Red Hat package) - update to 8.5.0-0.20210325041241.503db60.el8
python-oslo-config (Red Hat package) - update to 8.5.0-0.20210325050501.cfa2564.el8
openstack-ironic-inspector (Red Hat package) - update to 10.6.1-0.20210406091336.579f59c.el8
python-kubernetes (Red Hat package) - update to 12.0.1-1.el8
openstack-ironic (Red Hat package) - update to 17.0.4-0.20210713221218.a415e7e.el8
ovn2.13 (Red Hat package) - update to 20.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 48.84-4.el8
ostree (Red Hat package) - update to 2020.7-5.el8_4
ironic-images (Red Hat package) - update to 2021.1-20210614.1.el8

• https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2349

• Cross-site scripting in Jenkins Credentials plugin
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8 packages