Openshift: openshift: non-admin user can bypass resourcequota and flood etcd with events causing cluster-wide api degradation

Binutils: binutils: denial of service via crafted elf file

A vulnerability has been identified in the libarchive library

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable…

The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens

A flaw was found in python-oslo-utils

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site…

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers…

A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin

Sssd: sssd: denial of service via race condition in autofs responder

Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area

Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A vulnerability was found in Buildah

A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl…

In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted,…

Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection

It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the…

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission…

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a…

An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to…

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier

Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response

Libxml2: unbounded relaxng include recursion leading to stack overflow

A vulnerability was found in the netavark package, a network stack for containers used with Podman

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication

An input validation flaw was found in the way OpenShift 3 handles requests for images

Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply

A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux

Libxml2: libxml2: denial of service via crafted xml catalogs

Libxml2: stack buffer overflow in xmllint interactive shell command handling

OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server