The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1025 advisory.

  - workflow-cps: OS command execution through crafted SCM contents (CVE-2022-25173)

  - workflow-cps-global-lib: OS command execution through crafted SCM contents (CVE-2022-25174)

  - workflow-multibranch: OS command execution through crafted SCM contents (CVE-2022-25175)

  - workflow-cps: Pipeline-related plugins follow symbolic links or do not limit path names (CVE-2022-25176)

  - workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names     (CVE-2022-25177, CVE-2022-25178)

  - workflow-multibranch: Pipeline-related plugins follow symbolic links or do not limit path names     (CVE-2022-25179)

  - workflow-cps: Password parameters are included from the original build in replayed builds (CVE-2022-25180)

  - workflow-cps-global-lib: Sandbox bypass vulnerability (CVE-2022-25181, CVE-2022-25182, CVE-2022-25183)

  - pipeline-build-step: Password parameter default values exposed (CVE-2022-25184)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : OpenShift Container Platform 4.10.6 (RHSA-2022:1025)

high Nessus Plugin ID 159289

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.9 Apr 28, 2024, 2:25 PM Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404281425
Version 1.8 May 25, 2023, 3:03 PM Logic Changes (Added support for ppc64le architecture) Plugin Feed: 202305251503
Version 1.7 Jan 23, 2023, 9:47 PM Logic Changes (Added support for repository relative URLs) Plugin Feed: 202301232147
Version 1.6 Dec 15, 2022, 5:58 PM Detection Plugin Feed: 202212151758