The following flaw was found in Jenkins:
A vulnerability in the Jenkins remoting module allowed unauthenticated remote attackers to open a JRMP listener on the server hosting the Jenkins master process, which allowed arbitrary code execution.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24
cartridgerepository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.
Clayton Coleman reports:
Never use the form in ruby when the variables aren't known to be safe values
def self.downloadfromurl(url) maxdltime = (Rails.application.config.downloadedcartridges[:maxdownloadtime] rescue 10) || 10 maxfilesize = (Rails.application.config.downloadedcartridges[:maxcartsize] rescue 20480) || 20480 maxredirs = (Rails.application.config.downloadedcartridges[:maxdownloadredirects] rescue 2) || 2 curl --max-time #{maxdltime} --connect-timeout 2 --location --max-redirs #{maxredirs} --max-filesize #{maxfilesize} -k #{url} end
If 'URL' is not properly validated, then someone could inject " ; rm -rf /"
In this method, URL needs to be a properly formatted URI with a known whitelist of parameters.
In addition, we should only accept URI's that are of the following whitelisted criteria:
Parses URI successfully Protocol is 'http', 'https', 'git', 'ftp' (I can't think of others that are really safe). 'file' should NOT be allowed Host must be specified, and be non localhost (otherwise you allow a local injection attack). We need to be very careful here not to allow probing of the internal network, so we should only allow addresses that resolve outside of the exsrvs. Port should be valid Path should be valid
If the URI does not meet these criteria an error message should be returned to the user.
The following flaw was found in Jenkins:
Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.
This flaw could allow unauthenticated remote attackers to run arbitrary code on Jenkins.
Mitigation:
https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527.
Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282.
Kurt Seifried of Red Hat reports:
The OpenShift Enterprise openshift-origin-broker configures a default password:
/etc/openshift/broker.conf:MONGOPASSWORD="mooo" /etc/openshift/broker.conf:MONGOPASSWORD="mongopass"
Please note that the optional installer also did this previously:
https://github.com/openshift/openshift-extras/blob/enterprise-2.0/enterprise/install-scripts/generic/openshift.sh
mcollective has a default password set at install
IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 237402.
IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481.
In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.
Critical: Release of OpenShift Serverless 1.31.1
Critical: Release of OpenShift Serverless Client kn 1.31.1 security update
Critical: Errata Advisory for Red Hat OpenShift Builds 1.0.1
Critical: Red Hat OpenShift GitOps security update
Critical: Red Hat OpenShift GitOps security update
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
It was reported that by creating a new image with root password changed and using it as a sti builder image, attackers are able to gain ROOT in it. Overridding builder image scripts(e.g. assemble) can help the attackers to access the pod and/or perform remote command execution in it.
Product bugs (contain reproducer):
https://bugzilla.redhat.com/showbug.cgi?id=1315187 https://bugzilla.redhat.com/showbug.cgi?id=1315188
Upstream bug:
https://github.com/openshift/origin/pull/7864
Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.
Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.
Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.
Integer overflow in the gd2GetHeader function in gdgd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.
Red Hat OpenShift Enterprise 3.2 does not properly restrict access to STI builds, which allows remote authenticated users to access the Docker socket and gain privileges via vectors related to build-pod.
A flaw was found in source-to-image as shipped with Openshift Enterprise 3.6. A improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.
IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. IBM X-Force ID: 239081.
Cesar Wong of Red Hat reports:
Exec operations should be forbidden to privileged pods such as builder pods because they have privileged access to nodes. Currently, you can exec into any builder pod, getting privileged root access to the node it's running on.
It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed.
It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate.