Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Shared Groovy Libraries Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-25174 · ADVISORY
• jenkinsci/workflow-cps-global-lib-plugin commit ace0de3 · WEB
• CVEProject/cvelist · WEB
• jenkins.io/security/advisory/2022-02-15 · WEB

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib のその他の脆弱性

• CVE-2022-43406緊急 9.9A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with …
• CVE-2022-43405緊急 9.9A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission …
• CVE-2022-29047中 5.3Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull reque…
• CVE-2022-25183高 8.8Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache director…
• CVE-2022-25182高 8.8A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/…