PT-2022-1412 · Jenkins · Jenkins Docker Commons Plugin+1

Tomasz Szuba

·

Published

2022-01-12

·

Updated

2023-11-22

·

CVE-2022-20617

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Jenkins Docker Commons Plugin versions 1.17 and earlier
Description The issue is related to the Jenkins Docker Commons Plugin not sanitizing the name of an image or a tag, resulting in an OS command execution vulnerability. This can be exploited by attackers with Item/Configure permission or those able to control the contents of a previously configured job's SCM repository, allowing them to execute arbitrary commands.
Recommendations For Jenkins Docker Commons Plugin versions 1.17 and earlier, update to a version later than 1.17 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-00511
CVE-2022-20617
GHSA-JPXJ-VGQ5-PRJC
RHSA-2022:0339
RHSA-2022:0483
RHSA-2022:0491
RHSA-2022:0555
RHSA-2022:0565

Affected Products

Jenkins
Jenkins Docker Commons Plugin