OpenShift and Atomic Enterprise Ansible deploys a misconfigured etcd file that causes SSL client certificate authentication to be disabled. Quotations around the values of ETCDCLIENTCERTAUTH and ETCDPEERCLIENTCERTAUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication.

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.

The following flaw was found in Jenkins:

Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.

This flaw could allow unauthenticated remote attackers to run arbitrary code on Jenkins.

Mitigation:

https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

Heketi is used to manage GlusterFS nodes and volumes. The default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse.

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability..

Critical: OpenShift Container Platform 4.14.11 security and extras update

Critical: OpenShift Container Platform 4.14.11 bug fix and security update

Critical: OpenShift Container Platform 4.14.12 bug fix and security update

Critical: OpenShift Container Platform 4.13.33 security and extras update

Critical: OpenShift Container Platform 4.13.33 bug fix and security update

Critical: OpenShift Container Platform 4.12.50 security and extras update

Critical: OpenShift Container Platform 4.13.34 security update

Critical: OpenShift Container Platform 4.12.50 bug fix and security update

Critical: OpenShift Container Platform 4.15.0 security update

Critical: OpenShift Container Platform 4.15.0 security and extras update

Critical: OpenShift Container Platform 4.15.0 bug fix and security update

Critical: OpenShift Container Platform 4.12.51 bug fix and security update

Critical: OpenShift Container Platform 4.16.0 security and extras update

Critical: OpenShift Container Platform 4.16.0 bug fix and security update

OpenShift Container Platform 4.22.8 bug fix and security update

OpenShift Container Platform 4.19.41 bug fix and security update

OpenShift Container Platform 4.17.56 bug fix and security update

OpenShift Container Platform and OpenShift Online have a flaw in the source-to-image functionality. An attacker that can create images with the 'io.openshift.s2i.assemble-user' LABEL set to 'root' can execute arbitrary code with full privileges in the builder pod during S2I build.