RHSA-2022:1420: Important: OpenShift Container Platform 3.11.685 security and bug fix update

First published: Wed Apr 27 2022(Updated: )

Red Hat OpenShift Container Platform is Red Hat's cloud computing<br>Kubernetes application platform solution designed for on-premise or private<br>cloud deployments.<br>This advisory contains the RPM packages for Red Hat OpenShift Container<br>Platform 3.11.685. See the following advisory for the container images for this release:<br><a href="https://access.redhat.com/errata/RHBA-2022:1421" target="_blank">https://access.redhat.com/errata/RHBA-2022:1421</a> Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:<br><a href="https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html" target="_blank">https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html</a> <br>Security Fix(es):<br><li> workflow-cps: OS command execution through crafted SCM contents (CVE-2022-25173)</li> <li> workflow-cps-global-lib: OS command execution through crafted SCM contents (CVE-2022-25174)</li> <li> workflow-multibranch: OS command execution through crafted SCM contents (CVE-2022-25175)</li> <li> workflow-cps-global-lib: Sandbox bypass vulnerability (CVE-2022-25181)</li> <li> workflow-cps-global-lib: Sandbox bypass vulnerability (CVE-2022-25182)</li> <li> workflow-cps-global-lib: Sandbox bypass vulnerability (CVE-2022-25183)</li> <li> xstream: Injecting highly recursive collections or maps can cause a DoS (CVE-2021-43859)</li> <li> workflow-cps: Pipeline-related plugins follow symbolic links or do not limit path names (CVE-2022-25176)</li> <li> workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names (CVE-2022-25177)</li> <li> workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names (CVE-2022-25178)</li> <li> workflow-multibranch: Pipeline-related plugins follow symbolic links or do not limit path names (CVE-2022-25179)</li> <li> workflow-cps: Password parameters are included from the original build in replayed builds (CVE-2022-25180)</li> <li> pipeline-build-step: Password parameter default values exposed (CVE-2022-25184)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/severity
• agent/type
• agent/softwarecombine
• agent/last-modified-date
• agent/first-publish-date
• agent/remedy
• agent/title
• agent/description
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2022:1420
• agent/software-canonical-lookup
• agent/references
• agent/tags
• agent/event
• agent/source
• package-manager/redhat