CVE-2022-25180: Medium severity jenkins pipeline vulnerability

Q: What is the severity of CVE-2022-25180?

CVE-2022-25180 has a medium severity level as it allows unauthorized access to sensitive password parameters.

Q: How does CVE-2022-25180 affect Jenkins users?

CVE-2022-25180 affects Jenkins users by risking exposure of password parameters from previous builds during build replays.

Q: How do I fix CVE-2022-25180?

To fix CVE-2022-25180, update your Jenkins Pipeline: Groovy Plugin to the latest version available after the remedial version mentioned.

Q: Who is affected by CVE-2022-25180?

Any Jenkins user with run/replay permission on builds using the vulnerable version of the Pipeline: Groovy Plugin is affected by CVE-2022-25180.

Q: What versions of Jenkins are vulnerable to CVE-2022-25180?

Jenkins versions up to 2648.va9433432b33c are vulnerable to CVE-2022-25180.

Published Feb 15, 2022

Updated

A flaw was found in Jenkins. The Pipeline: Groovy Plugin includes password parameters from the original build in replayed builds. This flaw allows attackers with run/replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.

Other sources

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds.

This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.

Pipeline: Groovy Plugin 2656.vf7ae7b75a457 does not allow builds containing password parameters to be replayed.

Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds. This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.

References:

https://www.jenkins.io/security/advisory/2022-02-15/

— Red Hat

Affected Software

8 affected componentsFixes available

redhat/jenkins<2-plugins-0:3.11.1650371376-1.el7

2-plugins-0:3.11.1650371376-1.el7

redhat/jenkins<2-plugins-0:4.10.1647505461-1.el8

2-plugins-0:4.10.1647505461-1.el8

redhat/jenkins<2-plugins-0:4.6.1650364520-1.el8

2-plugins-0:4.6.1650364520-1.el8

redhat/jenkins<2-plugins-0:4.7.1648800585-1.el8

2-plugins-0:4.7.1648800585-1.el8

redhat/jenkins<2-plugins-0:4.8.1646993358-1.el8

2-plugins-0:4.8.1646993358-1.el8

redhat/jenkins<2-plugins-0:4.9.1647580879-1.el8

2-plugins-0:4.9.1647580879-1.el8

maven/org.jenkins-ci.plugins.workflow:workflow-cps<=2648.va9433432b33c

2656.vf7a_e7b_75a_457

Jenkins Pipeline\<=2648.va9433432b33c

Remediation

Patch Available

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2443

Event History

Feb 15, 2022

CVE Published

12:00 AM

CVE Published

via MITRE·04:11 PM

Data Sourced

via MITRE·04:11 PM

Description

Feb 16, 2022

Advisory Published

12:01 AM

Feb 17, 2022

Data Sourced

via Red Hat·04:23 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2022-25180?

CVE-2022-25180 has a medium severity level as it allows unauthorized access to sensitive password parameters.

How does CVE-2022-25180 affect Jenkins users?