CVE-2022-43403

描述

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Script Security Plugin 1184.v85d16b_d851b_3 intercepts per-element casts when casting array-like values to array types.

如何修補 CVE-2022-43403

要修補 CVE-2022-43403,請將受影響套件升級到下列已修補版本。

• —升級至 1184.v85d16b_d851b_3 或更新版本

CVE-2022-43403 正在被利用嗎?

低 — EPSS 為 1.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1184.v85d16b_d851b_3

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-43403
• WEBwww.openwall.com/lists/oss-security/2022/10/19/3
• WEBwww.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)
• WEBwww.secpod.com/blog/oracle-releases-critical-security-updates-january-2023-patch-now