Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update
google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization SnakeYaml: Constructor Deserialization Remote Code Execution http2-server: Invalid HTTP/2 requests cause DoS snakeyaml: Denial of Service due to missing nested depth limitation for collections plugin: CSRF vulnerability in Script Security Plugin plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin plugin: CSRF vulnerability in Blue Ocean Plugin plugin: missing permission checks in Blue Ocean Plugin jenkins: Observable timing discrepancy allows determining username validity jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Non-constant time webhook signature comparison in GitHub Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin mina-sshd: Java unsafe deserialization vulnerability jenkins-plugin/script-security: Whole-script approval in Script Security Plugin vulnerable to SHA-1 collisions jenkins-plugin/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability in Pipeline Utility Steps Plugin
cpe:/a:redhat:openshift:4.9::el8