(RHSA-2023:0017) Important: OpenShift Container Platform 4.8.56 packages and security update

Red Hat OpenShift Container Platform is Red Hat’s cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.56. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2023:0018

Security Fix(es):

• Pipeline Shared Groovy Libraries: Untrusted users can modify some
  Pipeline libraries in Pipeline Shared Groovy Libraries Plugin
  (CVE-2022-29047)
• Jenkins plugin: Sandbox bypass vulnerability through implicitly
  allowlisted platform Groovy files in Pipeline: Groovy Plugin
  (CVE-2022-30945)
• Jenkins plugin: Mercurial SCM plugin can check out from the controller
  file system (CVE-2022-30948)
• jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step
  Plugin (CVE-2022-34177)
• jenkins-plugin: Man-in-the-Middle (MitM) in
  org.jenkins-ci.plugins:git-client (CVE-2022-36881)
• http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)
• Jenkins plugin: CSRF vulnerability in Script Security Plugin
  (CVE-2022-30946)
• Jenkins plugin: User-scoped credentials exposed to other users by
  Pipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)
• Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)
• Jenkins plugin: missing permission checks in Blue Ocean Plugin
  (CVE-2022-30954)
• jenkins: Observable timing discrepancy allows determining username
  validity (CVE-2022-34174)
• jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin
  (CVE-2022-34176)
• jenkins-plugin: Cross-site Request Forgery (CSRF) in
  org.jenkins-ci.plugins:git (CVE-2022-36882)
• jenkins plugin: Lack of authentication mechanism in Git Plugin webhook
  (CVE-2022-36883)
• jenkins plugin: Lack of authentication mechanism in Git Plugin webhook
  (CVE-2022-36884)
• jenkins plugin: Non-constant time webhook signature comparison in GitHub
  Plugin (CVE-2022-36885)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.