PT-2022-15861 · Jenkins · Jenkins Debian Package Builder Plugin+1

Published 2022-01-12 · Updated 2023-11-30 · CVE-2022-23118

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Debian Package Builder Plugin versions 1.6.11 and earlier

Description The issue allows agents to invoke command-line git at an attacker-specified path on the controller. This enables attackers who can control agent processes to invoke arbitrary OS commands on the controller.

Recommendations For Jenkins Debian Package Builder Plugin versions 1.6.11 and earlier, consider disabling the functionality that allows agents to invoke command-line git at an attacker-specified path on the controller until a patch is available. Restrict access to the controller to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Exposure of Resource to Wrong Sphere

Improper Privilege Management

Weakness Enumeration

CWE-693

CWE-668

CWE-269

Related Identifiers

CVE-2022-23118

GHSA-8XJP-RP29-V5J8

Affected Products

Jenkins

Jenkins Debian Package Builder Plugin

References · 8

• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2546 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8xjp-rp29-v5j8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23118 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23118 · Vendor Advisory
• https://github.com/jenkinsci/debian-package-builder-plugin · Note
• https://t.me/cvenotify/25343 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note
• https://t.me/cvenotify/53178 · Telegram Post