Input validation error in Pipeline: Input Step - CVE-2022-34177
Published: June 23, 2022
Vulnerability identifier: #VU64608
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-34177
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient validation of user-supplied input in the "file" parameters. A remote user can create or replace arbitrary files on the Jenkins controller file system.
Affected software
Pipeline: Input Step
cri-o (Red Hat package)
jenkins (Red Hat package)
python-sushy (Red Hat package)
jenkins-2-plugins (Red Hat package)
openstack-ironic (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
Red Hat OpenShift Container Platform
cri-o (Red Hat package)
jenkins (Red Hat package)
python-sushy (Red Hat package)
jenkins-2-plugins (Red Hat package)
openstack-ironic (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
Red Hat OpenShift Container Platform
How to mitigate CVE-2022-34177
Install updates from vendor's website.
Pipeline: Input Step - update to 449.v77f0e8b_845c4
cri-o (Red Hat package) - addressed in versions 1.22.5-16.rhaos4.9.git88e9cdc.el7, 1.22.5-16.rhaos4.9.git88e9cdc.el8, 1.23.3-17.rhaos4.10.git016b1ca.el7, 1.23.3-17.rhaos4.10.git016b1ca.el8
jenkins (Red Hat package) - addressed in versions 2.346.3.1663151230-1.el8, 2.361.1.1669892772-1.el8, 2.361.1.1672840472-1.el8
python-sushy (Red Hat package) - update to 4.1.2-0.20220913104404.1ae8e49.el8
Red Hat OpenShift Container Platform - addressed in versions 4.8.56, 4.9.54
jenkins-2-plugins (Red Hat package) - addressed in versions 4.8.1672842762-1.el8, 4.9.1669894222-1.el8, 4.10.1663147786-1.el8
openstack-ironic (Red Hat package) - update to 19.0.1-0.20220907234401.d85d7f8.el8
openshift (Red Hat package) - addressed in versions 4.9.0-202211302226.p0.gc763d11.assembly.stream.el7, 4.9.0-202211302226.p0.gc763d11.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.9.0-202212060855.p0.g88cfeb4.assembly.stream.el7, 4.9.0-202212060855.p0.g88cfeb4.assembly.stream.el8
cri-o (Red Hat package) - addressed in versions 1.22.5-16.rhaos4.9.git88e9cdc.el7, 1.22.5-16.rhaos4.9.git88e9cdc.el8, 1.23.3-17.rhaos4.10.git016b1ca.el7, 1.23.3-17.rhaos4.10.git016b1ca.el8
jenkins (Red Hat package) - addressed in versions 2.346.3.1663151230-1.el8, 2.361.1.1669892772-1.el8, 2.361.1.1672840472-1.el8
python-sushy (Red Hat package) - update to 4.1.2-0.20220913104404.1ae8e49.el8
Red Hat OpenShift Container Platform - addressed in versions 4.8.56, 4.9.54
jenkins-2-plugins (Red Hat package) - addressed in versions 4.8.1672842762-1.el8, 4.9.1669894222-1.el8, 4.10.1663147786-1.el8
openstack-ironic (Red Hat package) - update to 19.0.1-0.20220907234401.d85d7f8.el8
openshift (Red Hat package) - addressed in versions 4.9.0-202211302226.p0.gc763d11.assembly.stream.el7, 4.9.0-202211302226.p0.gc763d11.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.9.0-202212060855.p0.g88cfeb4.assembly.stream.el7, 4.9.0-202212060855.p0.g88cfeb4.assembly.stream.el8
External References
Related Security Bulletins
- Arbitrary file write in Jenkins Pipeline: Input Step plugin
- Red Hat OpenShift Container Platform 4.10 for RHEL 8 update for Pipeline Input Step Plugin
- OpenShift Container Platform 4.9 update for Pipeline: Input Step Jenkins plugin
- Multiple vulnerabilities in OpenShift Container Platform 4.9
- Multiple vulnerabilities in OpenShift Container Platform 4.8