Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6.35 packages update
jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity (XXE) attacks. jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP endpoints. jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.
cpe:/a:redhat:openshift:4.6::el7 cpe:/a:redhat:openshift:4.6::el8