com.google.cloud.tools:jib-core vulnerable to Remote Code Execution (RCE)

CRÍTICO 9.8CVE-2022-25914 · GHSA-936v-cg49-m2g5 · Published 08/09/2022 · updated 17/06/2026

En resumen

CVE-2022-25914 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a com.google.cloud.tools:jib-core, jib (jib project).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.8%, mayor que el 78.0% de las vulnerabilidades.
Solución: actualizar a 0.22.0 o posterior.

Package	Affected versions	Patched versions
com.google.cloud.tools:jib-core Maven	`< 0.22.0`	`0.22.0`
jib jib_project	`< 0.22.0`	`0.22.0`

Description

The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting to execute input.

NVD description

The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting to execute input.

References

nvd.nist.gov/vuln/detail/CVE-2022-25914 · ADVISORY
GoogleContainerTools/jib#3744 · WEB
GoogleContainerTools/jib commit 67fa40b · WEB
GoogleContainerTools/jib · PACKAGE
security.snyk.io/vuln/SNYK-JAVA-COMGOOGLECLOUDTOOLS-2968871 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free