Red Hat Security Advisory 2023-0481-01 - Submariner enables direct networking between pods and services on different Kubernetes clusters that are either on-premises or in the cloud. This advisory contains bug fixes and enhancements to the Submariner container images.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: Submariner 0.12.3 - security update and bug fix  
Advisory ID:       RHSA-2023:0481-01  
Product:           Red Hat ACM  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:0481  
Issue date:        2023-01-26  
CVE Names:         CVE-2022-32149   
=====================================================================

1. Summary:

Submariner 0.12.3 packages that fix various bugs and add various  
enhancements that are now available for Red Hat Advanced Cluster Management  
for Kubernetes version 2.5.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Description:

Submariner enables direct networking between pods and services on different  
Kubernetes clusters that are either on-premises or in the cloud.

For more information about Submariner, see the Submariner open source  
community website at: https://submariner.io/.

This advisory contains bug fixes and enhancements to the Submariner  
container images.

Major bug addressed: 

ACM-2318: Submariner gateway node: Error updating load balancer with new  
hosts map

Security fix:

* CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage  
takes a long time to parse complex tags

3. Solution:

For details on how to install Submariner, refer to:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.5/html/add-ons/add-ons-overview#submariner-deploy-console

and

https://submariner.io/getting-started/

4. Bugs fixed (https://bugzilla.redhat.com/):

2134010 - CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags

5. JIRA issues fixed (https://issues.jboss.org/):

ACM-2318 - Submariner gateway node: Error updating load balancer with new hosts map

6. References:

https://access.redhat.com/security/cve/CVE-2022-32149  
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY9L/+tzjgjWX9erEAQiAkBAAgFGVRsLKFwitm8caXqJWJO+vkYy7NHUW  
YUsJ8hSkTIo4JOD29ARdXZXabZnvNWogGZYfOXI+kTKyE1Ojz+PmXfSl5j4/iETo  
OZzxX03BpoetYwWf6Q2V/kT+jTR2+X63G0SNLIWiLrTuqdF0aJ6ZSs5ptPGW8ovq  
fsBtHua2002yBSqQ1SgSQGB/Lj980+A4lC580NbcmbeFYicaUTibr76NTYQXXmWf  
PSCs08wYZ8XaIOdQM5myr/6KOoYAzx3GGMnrRg8t6jJVp0ss4Yf6rMbKUFGrZbT6  
ZKaU6kgOU1hCN8yuHn9OTtt/nibVzowzb0O545a9dZ8/cma5r9gr31pzrB5tty5O  
1ah0pYPfb4YPHnXwSJiGjcmlpfdyhG+xG+9znbLme/Cf+aNE8bkxvZRGMPXQYQps  
94N37bzFtf/Po3LrgM9RtpAHUIylQ5sLBgvhK5aOkdZR/D7Gufp/CbsEzDvNU82a  
kctOka+4GY65ZuT0zNi6XV87RYCGBV18eH81j+8KNHkseNRvHuegRV61BiOAqpom  
DWyp8UyQFksZwFR/u+MpjSgFWSBtABj4KoBBASm5+QKvXS18/9FnWjqLOEts9BXQ  
0S8IR18iEZblEfkDcQPtXNqkq8fSlx9SIJVT8BcYRVVajFZw+7vWlU1Q5WwpmeBZ  
U5Wpzu1l6Ks=  
=VmQk  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-0481-01

A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2023-24437

**Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin**

Moderate severity GitHub Reviewed Published Jan 26, 2023 to the GitHub Advisory Database • Updated Jan 27, 2023

**Package**

maven org.jenkins-ci.plugins:jira-steps (Maven)

**Affected versions**

<= 2.0.165.v8846cf59f3db

Last updated

Jan 27, 2023

Published to the GitHub Advisory Database

Jan 26, 2023

Published by the National Vulnerability Database

Jan 26, 2023

GHSA-r3gm-jwf4-xgv2: Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

**Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin**

Low severity GitHub Reviewed Published Jan 26, 2023 to the GitHub Advisory Database • Updated Jan 27, 2023

GHSA-g29v-5pwh-wxx4: Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin

A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVE-2023-24435: Jenkins Security Advisory 2023-01-24

Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVE-2023-24433: Jenkins Security Advisory 2023-01-24

A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.

CVE-2023-24423: Jenkins Security Advisory 2023-01-24

A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2023-24431: Jenkins Security Advisory 2023-01-24

A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account.

CVE-2023-24457: Jenkins Security Advisory 2023-01-24

A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Tag

#jira