Detections
Analytics
RHCOS 4 : OpenShift Container Platform 4.10.52 (RHSA-2023:0697)
critical Nessus Plugin ID 189438
Language:
Synopsis
The remote Red Hat CoreOS host is missing one or more security updates for OpenShift Container Platform 4.10.52.Description
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0697 advisory.- SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond. (CVE-2022-1471)
- In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. (CVE-2022-34174)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the RHCOS OpenShift Container Platform 4.10.52 package based on the guidance in RHSA-2023:0697.See Also
https://access.redhat.com/security/cve/CVE-2022-1471
Plugin Details
Severity: Critical
ID: 189438
File Name: rhcos-RHSA-2023-0697.nasl
Version: 1.0
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 1/24/2024
Updated: 1/24/2024
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2022-34174
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2022-1471
Vulnerability Information
CPE: cpe:/o:redhat:enterprise_linux:8:coreos, p-cpe:/a:redhat:enterprise_linux:jenkins, p-cpe:/a:redhat:enterprise_linux:jenkins-2-plugins
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/15/2023
Vulnerability Publication Date: 6/22/2022
Reference Information
CVE: CVE-2022-1471, CVE-2022-34174