Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Config_file_provider | Jenkins | * | 3.7.0 (including) |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-controller-rhel8:v1.4.6-4 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-log-reader-rhel8:v1.4.6-4 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-must-gather-rhel8:v1.4.6-4 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-operator-bundle:v1.4.6-5 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-registry-rhel8:v1.4.6-4 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-rsync-transfer-rhel8:v1.4.6-4 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-ui-rhel8:v1.4.6-4 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-velero-plugin-for-aws-rhel8:v1.4.6-4 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8:v1.4.6-3 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8:v1.4.6-4 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-velero-restic-restore-helper-rhel8:v1.4.6-5 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-migration-velero-rhel8:v1.4.6-5 | * |
| Red Hat Migration Toolkit for Containers 1.4 | RedHat | rhmtc/openshift-velero-plugin-rhel8:v1.4.6-4 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | jenkins-2-plugins-0:3.11.1624366838-1.el7 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | jenkins-2-plugins-0:4.5.1623326336-1.el7 | * |
| Red Hat OpenShift Container Platform 4.6 | RedHat | jenkins-2-plugins-0:4.6.1623162648-1.el8 | * |
| Red Hat OpenShift Container Platform 4.7 | RedHat | cri-o-0:1.20.2-12.rhaos4.7.git9f7be76.el7 | * |
| Red Hat OpenShift Container Platform 4.7 | RedHat | cri-tools-0:1.20.0-3.el7 | * |
| Red Hat OpenShift Container Platform 4.7 | RedHat | jenkins-2-plugins-0:4.7.1621361158-1.el8 | * |
| Red Hat OpenShift Container Platform 4.7 | RedHat | redhat-release-coreos-0:47.83-2.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | atomic-openshift-service-idler-0:4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | butane-0:0.12.1-1.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | console-login-helper-messages-0:0.20.3-1.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | coreos-installer-0:0.9.0-6.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | cri-o-0:1.21.2-5.rhaos4.8.gitb27d974.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | cri-tools-0:1.21.0-2.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | haproxy-0:2.2.13-1.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ignition-0:2.9.0-6.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ironic-images-0:2021.1-20210614.1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ironic-images-ipa-ppc64le-0:2021.1-20210614.1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ironic-images-ipa-x86_64-0:2021.1-20210614.1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | jenkins-0:2.289.1.1624020353-1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | jenkins-2-plugins-0:4.8.1624022417-1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | kata-containers-0:2.1.0-4.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openshift-0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openshift-ansible-0:4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openshift-clients-0:4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openshift-kuryr-0:4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openstack-ironic-1:17.0.4-0.20210713221218.a415e7e.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openstack-ironic-inspector-0:10.6.1-0.20210406091336.579f59c.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openstack-ironic-python-agent-0:7.0.2-0.20210611153100.bfa97cb.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openvswitch2.15-0:2.15.0-9.el8fdp | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ostree-0:2020.7-5.el8_4 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ovn2.13-0:20.12.0-25.el8fdp | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | podman-0:3.0.1-6.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-debtcollector-0:2.2.0-0.20210324220630.649189d.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-eventlet-0:0.25.2-4.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-hardware-0:0.27.0-0.20210406121246.756fedb.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-ironic-lib-0:4.6.2-0.20210608101214.ca2e4ba.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-ironic-prometheus-exporter-0:2.2.1-0.20210325143713.70e39c8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-jsonschema-0:3.2.0-5.el8ost | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-keystoneauth1-0:4.3.0-0.20210325001456.6a66271.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-kubernetes-0:12.0.1-1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-openshift-1:0.12.1-1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-openstacksdk-0:0.53.0-0.20210325011601.4629245.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-concurrency-0:4.4.0-0.20210325004915.7dcf9e9.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-config-2:8.5.0-0.20210325050501.cfa2564.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-context-0:3.2.0-0.20210325043103.0d02866.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-db-0:8.5.0-0.20210325041241.503db60.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-i18n-0:5.0.1-0.20210324221600.73187bd.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-log-0:4.4.0-0.20210409081224.9b29c90.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-policy-0:3.7.0-0.20210325051823.d853485.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-serialization-0:4.1.0-0.20210325012242.8445e61.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-service-0:2.5.0-0.20210325014731.d25e454.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-upgradecheck-0:1.3.0-0.20210325003851.9f95a6e.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-utils-0:4.8.0-0.20210325043201.3288539.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-pyrsistent-0:0.16.0-3.el8ost | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-stevedore-0:3.3.0-0.20210325001012.7d7154f.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-sushy-0:3.7.1-0.20210428165244.bc49878.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-sushy-oem-idrac-0:2.0.1-0.20210326152858.83b7eb0.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-tooz-0:2.8.0-0.20210324235001.54448e9.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | redhat-release-coreos-0:48.84-4.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | rteval-loads-0:1.4-12.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | runc-0:1.0.0-98.rhaos4.8.gitcd80260.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | rust-afterburn-0:5.0.0-1.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | toolbox-0:0.0.8-3.rhaos4.8.el8 | * |