Cross-site request forgery in Jenkins LTS and Jenkins - CVE-2022-20612

Vulnerability identifier: #VU59576

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20612

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in build triggers. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Jenkins LTS
Jenkins
Oracle Communications Cloud Native Core Automated Test Suite
Red Hat Advanced Cluster Management for Kubernetes
cri-o (Red Hat package)
jenkins (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
jenkins-2-plugins (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
containers-common (Red Hat package)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Jenkins LTS - update to 2.319.2
Jenkins - update to 2.330
cri-o (Red Hat package) - addressed in versions 1.19.4-6.rhaos4.6.git391175b.el7, 1.19.4-6.rhaos4.6.git391175b.el8, 1.21.4-10.rhaos4.8.gitc058478.el7, 1.21.4-10.rhaos4.8.gitc058478.el8
jenkins (Red Hat package) - addressed in versions 2.319.2.1643391771-1.el8, 2.319.2.1643648617-1.el8, 2.319.2.1643882372-1.el8, 2.319.2.1643964085-1.el8, 2.319.2.1644411558-1.el7
Red Hat OpenShift Container Platform - addressed in versions 3.11.634, 4.6.55, 4.7.43, 4.8.31, 4.9.19
atomic-openshift (Red Hat package) - update to 3.11.634-1.git.0.9b5be6d.el7
openshift-ansible (Red Hat package) - update to 3.11.634-1.git.0.86bbe6f.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.634-1.g99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.634-1.g13de638.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.634-1.g39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.634-1.gf8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.634-1.gc8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.634-1.gf2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.634-1.g737ee87.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.634-1.gd435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.634-1.g22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.634-1.gedebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.634-1.g609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.634-1.g2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.634-1.g99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.634-1.g3571208.el7
openshift-kuryr (Red Hat package) - addressed in versions 3.11.634-1.g0c4bf66.el7, 4.6.0-202201261116.p0.g74cd766.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 3.11.1644412543-1.el7, 4.6.1643965689-1.el8, 4.7.1643883495-1.el8, 4.8.1643649345-1.el8, 4.9.1643389956-1.el8
openshift (Red Hat package) - addressed in versions 4.6.0-202201200342.p0.g35fca9a.assembly.stream.el7, 4.6.0-202201200342.p0.g35fca9a.assembly.stream.el8, 4.8.0-202202050715.p0.gb82a451.assembly.stream.el7, 4.8.0-202202050715.p0.gb82a451.assembly.stream.el8, 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el7, 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.8.0-202202071729.p0.g9aacc90.assembly.stream.el7, 4.8.0-202202071729.p0.g9aacc90.assembly.stream.el8
containers-common (Red Hat package) - update to 1-15.rhaos4.8.el8
Red Hat Advanced Cluster Management for Kubernetes - update to 2.3.6

• https://jenkins.io/security/advisory/2022-01-12/

• Cross-site request forgery in Jenkins and LTS
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• OpenShift Container Platform 4.7 update for Jenkins
• Red Hat OpenShift Container Platform 4.8 update for Jenkins
• Multiple vulnerabilities in OpenShift Container Platform 3.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.6
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3