Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Red Hat OpenShift 3.2 RHSA-2016-1206-01 Moderate: Jenkins Security Fix

red hat
Calendar Grey June 6, 2016
Scroller Redhat
Enhanced Jenkins deployment and container image, incorporating security enhancements accessible for Red Hat OpenShift Enterprise 3.2, rated as Moderate.
An updated Jenkins package and image that includes security fixes are now available for Red Hat OpenShift Enterprise 3.2

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

OpenShift Enterprise by Red Hat is the company's cloud computing Platform- as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.
Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron.
Security Fix(es):
* The Jenkins continuous integration server has been updated to upstream version 1.651.2 LTS that addresses a large number of security issues, including open redirects, a potential denial of service, unsafe handling of user provided environment variables and several instances of sensitive information disclosure. (CVE-2016-3721, CVE-2016-3722, CVE-2016-3723, CVE-2016-3724, CVE-2016-3725, CVE-2016-3726, CVE-2016-3727)
Refer to the changelog listed in the References section for a list of changes.
This update includes the following image:
openshift3/jenkins-1-rhel7:1.651.2-4
All OpenShift Enterprise 3.2 users are advised to upgrade to the updated package and image.

Topics%20covered

Topics Covered

security advisory moderate red hat security fix cloud platform jenkins open shift

References

https://access.redhat.com/security/cve/CVE-2016-3721 https://access.redhat.com/security/cve/CVE-2016-3722 https://access.redhat.com/security/cve/CVE-2016-3723 https://access.redhat.com/security/cve/CVE-2016-3724 https://access.redhat.com/security/cve/CVE-2016-3725 https://access.redhat.com/security/cve/CVE-2016-3726 https://access.redhat.com/security/cve/CVE-2016-3727 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat OpenShift Enterprise 3.1:
Source: jenkins-1.651.2-1.el7.src.rpm jenkins-plugin-openshift-pipeline-1.0.12-1.el7.src.rpm
noarch: jenkins-1.651.2-1.el7.noarch.rpm
x86_64: jenkins-plugin-openshift-pipeline-1.0.12-1.el7.x86_64.rpm
Red Hat OpenShift Enterprise 3.2:
Source: jenkins-1.651.2-1.el7.src.rpm jenkins-plugin-openshift-pipeline-1.0.12-1.el7.src.rpm
noarch: jenkins-1.651.2-1.el7.noarch.rpm
x86_64: jenkins-plugin-openshift-pipeline-1.0.12-1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Advisory ID: RHSA-2016:1206-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1206
Issue date: 2016-06-06

Topic

An updated Jenkins package and image that includes security fixes are now available for Red Hat OpenShift Enterprise 3.2.Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate red hat security fix cloud platform jenkins open shift

Relevant Releases Architectures

Red Hat OpenShift Enterprise 3.1 - noarch, x86_64

Red Hat OpenShift Enterprise 3.2 - noarch, x86_64

Bugs Fixed

1333133 - better retry in accessing replication controllers from openshift jenkin-plugin

1335415 - CVE-2016-3721 jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170)

1335416 - CVE-2016-3722 jenkins: Malicious users with multiple user accounts can prevent other users from logging in (SECURITY-243)

1335417 - CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

1335418 - CVE-2016-3724 jenkins: Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration (SECURITY-266)

1335420 - CVE-2016-3725 jenkins: Regular users can trigger download of update site metadata (SECURITY-273)

1335421 - CVE-2016-3726 jenkins: Open redirect to scheme-relative URLs (SECURITY-276)

1335422 - CVE-2016-3727 jenkins: Granting the permission to read node configurations allows access to overall system configuration (SECURITY-281)

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.