5 - RHSA-2019:1851

Problem Description:

An update for atomic-openshift and jenkins-2-plugins is now available for Red Hat OpenShift Container Platform 3.11.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.11 - noarch, ppc64le, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

Security Fix(es):

* web-console: XSS in OAuth server /oauth/token/request endpoint (CVE-2019-3876)

* jenkins-plugin-token-macro: XML External Entity processing the ${XML} macro (CVE-2019-10337)

* kube-apiserver: DoS with crafted patch of type json-patch (CVE-2019-1002100)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

4. Solution:

For OpenShift Container Platform 3.11 see the following documentation for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r elease_notes.html

5. Bugs fixed (https://bugzilla.redhat.com/):

1683190 - CVE-2019-1002100 kube-apiserver: DoS with crafted patch of type json-patch 1691107 - CVE-2019-3876 web-console: XSS in OAuth server /oauth/token/request endpoint 1719782 - CVE-2019-10337 jenkins-plugin-token-macro: XML External Entity processing the ${XML} macro