PT-2022-17116 · Jenkins · Jenkins Pipeline: Shared Groovy Libraries Plugin+1

Published 2022-02-15 · Updated 2023-11-30 · CVE-2022-25177

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier

Description The issue allows attackers who can configure Pipelines to read arbitrary files on the Jenkins controller file system. This is because the plugin follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step.

Recommendations For versions 552.vd9cc05b8a2e1 and earlier, consider restricting access to the libraryResource step until a patch is available. As a temporary workaround, avoid using the libraryResource step to read files from untrusted sources.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2022-25177

GHSA-Q234-X887-9RXH

RHSA-2022:0871

RHSA-2022:1021

RHSA-2022:1025

RHSA-2022:1248

RHSA-2022:1420

RHSA-2022:1620

Affected Products

Jenkins

Jenkins Pipeline: Shared Groovy Libraries Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-25177 · Security Note
• https://osv.dev/vulnerability/GHSA-q234-x887-9rxh · Vendor Advisory
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2613 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25177 · Vendor Advisory
• https://github.com/jenkinsci/workflow-cps-global-lib-plugin · Note
• https://t.me/cvenotify/27256 · Telegram Post
• https://t.me/cvenotify/26831 · Telegram Post