Red Hat OpenShift Container Platform is Red Hat’s cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.56. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2023:0018

Security Fix(es):

* Pipeline Shared Groovy Libraries: Untrusted users can modify some
Pipeline libraries in Pipeline Shared Groovy Libraries Plugin
(CVE-2022-29047)
* Jenkins plugin: Sandbox bypass vulnerability through implicitly
allowlisted platform Groovy files in Pipeline: Groovy Plugin
(CVE-2022-30945)
* Jenkins plugin: Mercurial SCM plugin can check out from the controller
file system (CVE-2022-30948)
* jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step
Plugin (CVE-2022-34177)
* jenkins-plugin: Man-in-the-Middle (MitM) in
org.jenkins-ci.plugins:git-client (CVE-2022-36881)
* http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)
* Jenkins plugin: CSRF vulnerability in Script Security Plugin
(CVE-2022-30946)
* Jenkins plugin: User-scoped credentials exposed to other users by
Pipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)
* Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)
* Jenkins plugin: missing permission checks in Blue Ocean Plugin
(CVE-2022-30954)
* jenkins: Observable timing discrepancy allows determining username
validity (CVE-2022-34174)
* jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin
(CVE-2022-34176)
* jenkins-plugin: Cross-site Request Forgery (CSRF) in
org.jenkins-ci.plugins:git (CVE-2022-36882)
* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook
(CVE-2022-36883)
* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook
(CVE-2022-36884)
* jenkins plugin: Non-constant time webhook signature comparison in GitHub
Plugin (CVE-2022-36885)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.Read More