CVE-2022-30945

Reference Links

• http://www.openwall.com/lists/oss-security/2022/05/17/8
• https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359
• https://access.redhat.com/errata/RHSA-2023:0017
• https://access.redhat.com/security/cve/cve-2022-30945
• https://bugzilla.redhat.com/show_bug.cgi?id=2119642
• https://www.cve.org/CVERecord?id=CVE-2022-30945 https://nvd.nist.gov/vuln/detail/CVE-2022-30945 https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2023:0017

Frequently Asked Questions

• What is the severity of CVE-2022-30945?

  CVE-2022-30945 is classified as a high severity vulnerability due to its potential impact on Jenkins installations.

• How do I fix CVE-2022-30945?

  To fix CVE-2022-30945, upgrade the Jenkins Pipeline: Groovy Plugin to version 2689.v434009a_31b_f2 or later.

• What impact does CVE-2022-30945 have on Jenkins security?

  CVE-2022-30945 allows unauthorized loading of Groovy source files in sandboxed pipelines, potentially leading to code execution risk.

• Which versions of Jenkins are affected by CVE-2022-30945?

  CVE-2022-30945 affects Jenkins Pipeline: Groovy Plugin versions 2689.v434009a_31b_f1 and earlier.

• Can CVE-2022-30945 lead to remote code execution?

  Yes, CVE-2022-30945 can potentially lead to remote code execution through the exploitation of Groovy scripts in Jenkins.