Security features bypass in Pipeline: Groovy - CVE-2022-30945

Vulnerability identifier: #VU63358

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30945

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the system.

The vulnerability exists due to the sandbox bypass issue through implicitly allowlisted platform Groovy files. A remote user can bypass sandbox protections.

Pipeline: Groovy
Red Hat OpenShift Container Platform
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)

Install updates from vendor's website.

Pipeline: Groovy - update to 2692.v76b_089ccd026
Red Hat OpenShift Container Platform - update to 4.8.56
jenkins (Red Hat package) - update to 2.361.1.1672840472-1.el8
jenkins-2-plugins (Red Hat package) - update to 4.8.1672842762-1.el8

• https://jenkins.io/security/advisory/2022-05-17/

• Security features bypass in Jenkins Pipeline: Groovy plugin
• Multiple vulnerabilities in OpenShift Container Platform 4.8