OS Command Injection in Docker Commons - CVE-2022-20617

Vulnerability identifier: #VU59583

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20617

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the name of an image or a tag. A remote authenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Docker Commons
cri-o (Red Hat package)
jenkins (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
jenkins-2-plugins (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
containers-common (Red Hat package)
Red Hat OpenShift Container Platform
Red Hat Advanced Cluster Management for Kubernetes

Install updates from vendor's website.

Docker Commons - update to 1.18
cri-o (Red Hat package) - addressed in versions 1.19.4-6.rhaos4.6.git391175b.el7, 1.19.4-6.rhaos4.6.git391175b.el8, 1.21.4-10.rhaos4.8.gitc058478.el7, 1.21.4-10.rhaos4.8.gitc058478.el8
jenkins (Red Hat package) - addressed in versions 2.319.2.1643391771-1.el8, 2.319.2.1643648617-1.el8, 2.319.2.1643882372-1.el8, 2.319.2.1643964085-1.el8, 2.319.2.1644411558-1.el7
Red Hat OpenShift Container Platform - addressed in versions 3.11.634, 4.6.55, 4.7.43, 4.8.31, 4.9.19
atomic-openshift (Red Hat package) - update to 3.11.634-1.git.0.9b5be6d.el7
openshift-ansible (Red Hat package) - update to 3.11.634-1.git.0.86bbe6f.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.634-1.g99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.634-1.g13de638.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.634-1.g39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.634-1.gf8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.634-1.gc8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.634-1.gf2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.634-1.g737ee87.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.634-1.gd435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.634-1.g22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.634-1.gedebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.634-1.g609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.634-1.g2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.634-1.g99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.634-1.g3571208.el7
openshift-kuryr (Red Hat package) - addressed in versions 3.11.634-1.g0c4bf66.el7, 4.6.0-202201261116.p0.g74cd766.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 3.11.1644412543-1.el7, 4.6.1643965689-1.el8, 4.7.1643883495-1.el8, 4.8.1643649345-1.el8, 4.9.1643389956-1.el8
openshift (Red Hat package) - addressed in versions 4.6.0-202201200342.p0.g35fca9a.assembly.stream.el7, 4.6.0-202201200342.p0.g35fca9a.assembly.stream.el8, 4.8.0-202202050715.p0.gb82a451.assembly.stream.el7, 4.8.0-202202050715.p0.gb82a451.assembly.stream.el8, 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el7, 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.8.0-202202071729.p0.g9aacc90.assembly.stream.el7, 4.8.0-202202071729.p0.g9aacc90.assembly.stream.el8
containers-common (Red Hat package) - update to 1-15.rhaos4.8.el8
Red Hat Advanced Cluster Management for Kubernetes - update to 2.3.6

• https://jenkins.io/security/advisory/2022-01-12/

• OS Command Injection in Jenkins Docker Commons plugin
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• OpenShift Container Platform 4.7 update for Jenkins
• Red Hat OpenShift Container Platform 4.8 update for Jenkins
• Multiple vulnerabilities in OpenShift Container Platform 3.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3