CVE-2022-45379: Weak Encryption
A flaw was found in the script-security Jenkins Plugin. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest. The affected version of the script-security Plugin stores whole-script approvals as the SHA-1 hash of the approved script.
Other sources
Jenkins Script Security Plugin 1189.vbab7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.
Script Security Plugin 1189.vbab7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the approved script. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest.
Script Security Plugin 1190.v65867aa47126 uses SHA-512 for new whole-script approvals. Previously approved scripts will have their SHA-1 based whole-script approval replaced with a corresponding SHA-512 whole-script approval when the script is next used.
Whole-script approval only stores the SHA-1 or SHA-512 hash, so it is not possible to migrate all previously approved scripts automatically on startup.
Administrators concerned about SHA-1 collision attacks on the whole-script approval feature are able to revoke all previous (SHA-1) script approvals on the In-Process Script Approval page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.10.1675144701-1.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.9.1675668922-1.el8 - Upgrade
Upgrade
maven/org.jenkins-ci.plugins:script-securityto a version that resolves this vulnerability.Fixed in 1190.v65867a_a_47126 - Upgrade
Upgrade
redhat/Script Security Pluginto a version that resolves this vulnerability.Fixed in 1190. - Upgrade
Upgrade
Jenkins Script Security Pluginto a version that resolves this vulnerability.Fixed in 1190.v65867a_a_47126 - Configuration
Administrators concerned about SHA-1 collision attacks should revoke all previous (SHA-1) script approvals on the In-Process Script Approval page.
Jenkins In-Process Script Approval page whole-script approval (SHA-1) = Revoke all previous (SHA-1) script approvals - Operational
After revoking SHA-1 whole-script approvals, previously approved scripts will have their SHA-1 based whole-script approval replaced with a corresponding SHA-512 whole-script approval when the script is next used.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-45379?
CVE-2022-45379 is classified as a high-severity vulnerability due to the use of SHA-1 for script approval in Jenkins.
How do I fix CVE-2022-45379?
To fix CVE-2022-45379, upgrade the Jenkins Script Security Plugin and Jenkins to the recommended versions or later.
Which versions of Jenkins are affected by CVE-2022-45379?
CVE-2022-45379 affects Jenkins installations with the script-security plugin versions prior to 1190.v65867a_a_47126.
What functionality is impacted by CVE-2022-45379?
CVE-2022-45379 impacts the security of script approvals by using the outdated SHA-1 hashing algorithm.
Is there a workaround for CVE-2022-45379 until I can upgrade?
Currently, there is no known effective workaround for CVE-2022-45379, so upgrading is strongly advised.