PT-2022-26886 · Jenkins · Jenkins Pipeline: Groovy Plugin+1

Daniel Beck + 1 · Published 2022-10-19 · Updated 2023-11-22 · CVE-2022-43402

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Plugin versions 2802.v5ea 628154b c2 and earlier

Description A sandbox bypass issue involves implicit casts by the Groovy language runtime, allowing attackers with permission to define and run sandboxed scripts to bypass sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Recommendations For versions 2802.v5ea 628154b c2 and earlier, update to a version that intercepts Groovy casts performed implicitly by the Groovy language runtime, such as version 2803.v1a f77ffcc773 or later.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2022-43402

GHSA-MQC2-W9R8-MMXM

RHSA-2023:0560

RHSA-2023:0777

RHSA-2023:1064

RHSA-2023:3198

Affected Products

Jenkins

Jenkins Pipeline: Groovy Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-43402 · Security Note
• https://osv.dev/vulnerability/GHSA-mqc2-w9r8-mmxm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43402 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/10/19/3 · Note
• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1) · Note