CVE-2022-43402

描述

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Pipeline: Groovy Plugin 2803.v1a_f77ffcc773 intercepts Groovy casts performed implicitly by the Groovy language runtime

如何修補 CVE-2022-43402

要修補 CVE-2022-43402,請將受影響套件升級到下列已修補版本。

• —升級至 2803.v1a_f77ffcc773 或更新版本

CVE-2022-43402 正在被利用嗎?

低 — EPSS 為 1.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 2803.v1a_f77ffcc773

CVSS 分數

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-43402
• WEBwww.openwall.com/lists/oss-security/2022/10/19/3
• WEBwww.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)