6.5 - RHSA-2019:2651

Problem Description:

An update for jenkins-2-plugins is now available for Red Hat OpenShift Container Platform 3.11.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.11 - noarch

3. Description:

Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron.

Security Fix(es):

* jenkins-plugin-script-security: Sandbox bypass through type casts in Script Security Plugin (CVE-2019-10355)

* jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin (CVE-2019-10356)

* jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin (CVE-2019-10357)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

4. Solution:

See the following documentation, which will be updated shortly for release 3.11.141, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r elease_notes.html

5. Bugs fixed (https://bugzilla.redhat.com/):

1735515 - CVE-2019-10355 jenkins-plugin-script-security: Sandbox bypass through type casts in Script Security Plugin 1735518 - CVE-2019-10356 jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin 1735521 - CVE-2019-10357 jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin