CVE-2022-29047: High severity jenkins pipeline vulnerability
A flaw was found in the Jenkins Pipeline: Shared Groovy Libraries plugin. The Jenkins Pipeline: Shared Groovy Libraries plugin allows attackers to submit pull requests. However, the attacker cannot commit directly to the configured Source Control Management (SCM) to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even with the Pipeline configured not to trust them.
Other sources
Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-29047?
CVE-2022-29047 is classified as a medium severity vulnerability that affects Jenkins Pipeline: Shared Groovy Libraries Plugin.
How do I fix CVE-2022-29047?
To fix CVE-2022-29047, upgrade to Jenkins Pipeline: Shared Groovy Libraries Plugin version 2.21.3 or later.
Who is affected by CVE-2022-29047?
CVE-2022-29047 affects users of the Jenkins Pipeline: Shared Groovy Libraries Plugin version 564.ve62a_4eb_b_e039 and earlier.
What types of issues does CVE-2022-29047 cause?
CVE-2022-29047 allows unauthorized modification of pipeline behavior through pull requests.
Is there a workaround for CVE-2022-29047?
There is no official workaround for CVE-2022-29047; upgrading to the fixed version is strongly recommended.