PT-2022-1879 · Hashicorp+1 · Jenkins Hashicorp Vault Plugin+1

Daniel Beck · Published 2022-02-15 · Updated 2023-11-03 · CVE-2022-25197

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins HashiCorp Vault Plugin versions 336.v182c0fbaaeb7 and earlier

Description The issue allows agent processes to read arbitrary files on the Jenkins controller file system. This can be exploited by attackers who can control agent processes, enabling them to read arbitrary files on the Jenkins controller file system. The vulnerability is related to a violation of the data protection mechanism.

Recommendations For Jenkins HashiCorp Vault Plugin versions 336.v182c0fbaaeb7 and earlier, update to a version later than 336.v182c0fbaaeb7 to resolve the issue. For Jenkins 2.318 and earlier, LTS 2.303.2 and earlier, consider upgrading to a newer version, such as Jenkins LTS 2.303.3 or later, to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to agent processes to minimize the risk of exploitation.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2022-01384

CVE-2022-25197

GHSA-2587-W93G-63M2

Affected Products

Jenkins

Jenkins Hashicorp Vault Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2022-25197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25197 · Security Note
• https://bdu.fstec.ru/vul/2022-01384 · Security Note
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2521 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2587-w93g-63m2 · Vendor Advisory
• https://github.com/jenkinsci/hashicorp-vault-plugin/releases/tag/351.vdb_f83a_1c6a_9d · Note
• https://github.com/jenkinsci/hashicorp-vault-plugin · Note
• https://github.com/jenkinsci/hashicorp-vault-plugin/commit/c564958154e5b2eccb2423b0aaabd01b928f71fc · Note
• https://t.me/cibsecurity/37513 · Telegram Post