title: Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update
description: CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix apache-commons-collections: InvokerTransformer code execution during deserialisation jenkins: Remote code execution vulnerability in remoting module (SECURITY-232) jenkins: HTTP response splitting vulnerability (SECURITY-238) jenkins: Non-constant time comparison of API token (SECURITY-241) jenkins: Non-constant time comparison of CSRF crumbs (SECURITY-245) jenkins: Remote code execution through remote API (SECURITY-247) jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170) jenkins: Malicious users with multiple user accounts can prevent other users from logging in (SECURITY-243) jenkins: Information on installed plugins exposed via API (SECURITY-250) jenkins: Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration (SECURITY-266) jenkins: Regular users can trigger download of update site metadata (SECURITY-273) jenkins: Open redirect to scheme-relative URLs (SECURITY-276) jenkins: Granting the permission to read node configurations allows access to overall system configuration (SECURITY-281)
cpes: cpe:/a:redhat:openshift:2.0::el6