CVE-2022-25177

描述

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.

如何修補 CVE-2022-25177

要修補 CVE-2022-25177,請將受影響套件升級到下列已修補版本。

• —升級至 561.va_ce0de3c2d69 或更新版本

CVE-2022-25177 正在被利用嗎?

低 — EPSS 為 1.7%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 2.22, < 561.va_ce0de3c2d69

CVSS 分數

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-25177
• PATCHgithub.com/jenkinsci/workflow-cps-global-lib-plugin
• WEBwww.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613