CVE-2022-29184

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-29184
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29184.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-29184
Aliases
  • GHSA-vf5r-r7j2-cf2h
Published
2022-05-20T19:25:14Z
Modified
2026-07-22T02:24:27.935951Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Command Injection/Argument Injection in GoCD
Details

GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on the GoCD server via configuring a malicious branch name which abuses Mercurial hooks/aliases to exploit a command injection weakness. An attacker would require access to an account with existing GoCD administration permissions to either create/edit (hg-based) configuration repositories; create/edit pipelines and their (hg-based) materials; or, where "pipelines-as-code" configuration repositories are used, to commit malicious configuration to such an external repository which will be automatically parsed into a pipeline configuration and (hg) material definition by the GoCD server. This issue is fixed in GoCD 22.1.0. As a workaround, users who do not use/rely upon Mercurial materials can uninstall/remove the hg/Mercurial binary from the underlying GoCD Server operating system or Docker image.

Database specific 
{
    "cwe_ids": [
        "CWE-77",
        "CWE-88"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29184.json"
}
References

Affected packages

Git / github.com/gocd/gocd

Affected ranges

Type
GIT
Repo
https://github.com/gocd/gocd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f4c9c1650e2e27fe0a9962faa39536f94f57e297
Fixed
37d35115db2ada2190173f9413cfe1bc6c295ecb
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "22.1.0"
        }
    ],
    "cpe": "cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*"
}

Affected versions

14.*
14.2.0
14.3.0
14.4.0
15.*
15.1.0
15.2.0
15.3.0
16.*
16.1.0
16.10.0
16.11.0
16.12.0
16.2.0
16.3.0
16.4.0
16.5.0
16.6.0
16.7.0
16.8.0
16.9.0
17.*
17.1.0
17.10.0
17.11.0
17.12.0
17.2.0
17.3.0
17.4.0
17.5.0
17.6.0
17.7.0
17.8.0
17.9.0
18.*
18.1.0
18.10.0
18.11.0
18.12.0
18.2.0
18.3.0
18.4.0
18.5.0
18.6.0
18.7.0
18.8.0
18.9.0
19.*
19.1.0
19.10.0
19.11.0
19.12.0
19.2.0
19.3.0
19.4.0
19.5.0
19.6.0
19.7.0
19.8.0
19.9.0
20.*
20.1.0
20.10.0
20.2.0
20.3.0
20.4.0
20.5.0
20.6.0
20.7.0
20.8.0
20.9.0
21.*
21.1.0
21.2.0
21.3.0
21.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29184.json"
vanir_signatures_modified 
"2026-07-22T02:24:27Z"
vanir_signatures 
[
    {
        "digest": {
            "length": 339.0,
            "function_hash": "277686828115175160626103866335989489805"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-075d41c3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "modificationsSince",
            "file": "domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java"
        }
    },
    {
        "digest": {
            "length": 336.0,
            "function_hash": "41756437660128987505765612648074900919"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-16d84929",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "findRecentModifications",
            "file": "domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java"
        }
    },
    {
        "digest": {
            "length": 387.0,
            "function_hash": "45364524151157000305380267180280483645"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-44403fb9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "shouldNotGetModificationsFromOtherBranches",
            "file": "common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"
        }
    },
    {
        "digest": {
            "length": 203.0,
            "function_hash": "20296423806307716788779294493390940686"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-48e90d3b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "checkConnection",
            "file": "domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java"
        }
    },
    {
        "digest": {
            "length": 272.0,
            "function_hash": "195819977323848723949219172936150138817"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-4a9ea606",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "shouldThrowExceptionIfUpdateFails",
            "file": "common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"
        }
    },
    {
        "digest": {
            "length": 287.0,
            "function_hash": "265965133634377081392148788441778707370"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-54e7f2c9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "clone",
            "file": "domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java"
        }
    },
    {
        "digest": {
            "length": 350.0,
            "function_hash": "306989524575135636740696097359008269313"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-715b6339",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "shouldGetLatestModifications",
            "file": "common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"
        }
    },
    {
        "digest": {
            "length": 96.0,
            "function_hash": "176402828332043674955076136706488273973"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-73fb38e7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "shouldCloneFromRemoteRepo",
            "file": "common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"
        }
    },
    {
        "digest": {
            "length": 333.0,
            "function_hash": "145520766394271776183923797346271546857"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-785a3a1c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "shouldNotIncludeCommitFromAnotherBranchInGetLatestModifications",
            "file": "common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "99862452430027719910081147550839296330",
                "103625639480383592198915416643930782312",
                "199488466470648879558212759353047545163",
                "133846424447767325109671217211775908699",
                "319079973519767813424683916530779672325",
                "175048437384401087854543873691342474999",
                "301687626271228334475079094274840328728",
                "111447377736944001848332915398839802622",
                "129896359587484341952447036253904410533",
                "55813602740054720036807898462650569485",
                "25975300251896800700010672712162562257",
                "158657086511925862169679072245155689404",
                "145719862768020879567720245810116125715",
                "215910125453702895015980510798282788343",
                "193679241370104892230564555402699912255",
                "213905516100836339604092090947331498308",
                "15280479407438311419666835501291128039",
                "140398798845240316461001514808605714134",
                "260908036667298120381063421141133927132",
                "141219351439798595834322670420400340561",
                "124612989227344696457848356726614070296",
                "118192183312211891524070685300148691702",
                "312740641161522007796730306816107632284",
                "316263195163759202763123278030407729009",
                "305730292505604537276532844472342201962",
                "288062059188498850462952256715354751192",
                "189944871796042697413990790091233864524",
                "183152790747637562169830902265202867830",
                "169459198651268401112080033838372513942",
                "257037923149726238899368433762837882818",
                "140445152693042796762272352753323473588",
                "135184547433740646873405968638829591370",
                "13879130112967971210445332783675964794",
                "170143744587504626175307080821882926458",
                "132201807361622338894939363426000245047",
                "270243584828025414520252145755749404851",
                "87539375011378343653960706090265938797",
                "14534708136508035591563111624332913084",
                "97622748712036927092110412280062670648",
                "59458027138940331803003820933902848024",
                "299947249237432107527830222560665715685",
                "268305481440360634109698797731070285966",
                "127671362428178164019680515446775444594",
                "122749094938931484287106715703011850066",
                "212114508730904533524163100824331100648"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2022-29184-7dbb9b2c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "file": "common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"
        }
    },
    {
        "digest": {
            "length": 354.0,
            "function_hash": "25019327673332204383710143340009606232"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-8dad0234",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "templatePath",
            "file": "domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java"
        }
    },
    {
        "digest": {
            "length": 225.0,
            "function_hash": "181186856904845567293496482563688630985"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-9bce51da",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "shouldThrowExceptionForBadConnection",
            "file": "common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"
        }
    },
    {
        "digest": {
            "length": 195.0,
            "function_hash": "132321672288271824051512897744815848981"
        },
        "deprecated": false,
        "id": "CVE-2022-29184-b4ae2ad1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "function": "pull",
            "file": "domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "210267668920354936303607642940069050170",
                "330953421107129250925006173871856419843",
                "117388941233977526338368203545979976560",
                "335858727788507751481872018961076273717",
                "103151244510056177135580506240936872730",
                "263902032936920929295103291043503335231",
                "289358396723882523170304895314123792026",
                "84246409819928601517728027197574550512",
                "253170136964569131558334517003358469044",
                "11700514443476027148325822742446592851",
                "113397999953854579418732023686275250176",
                "53482601318655409529032877584216371673",
                "279675351122017986156491083829158687232",
                "101448108246872540339213789477906274607",
                "163211089742704882806326490613762157820",
                "85139259905615528914129915301818860952",
                "315439472601678501093519928230779086136",
                "148010278994894773713670729622151993252",
                "237016048707710917936537910426964105270",
                "225425968430376769302205455756989754675",
                "31091398584587903641009640687874296627",
                "212157060610584044716101722764803315215",
                "239837388635309663427523832415756441041",
                "2543445209339795015400832211819408267",
                "292442778917862568270150239501180538090",
                "267199097621656342054775518555950727718",
                "325284330931153869259029768336146606861",
                "219481154712325788555024983885673330527",
                "204801778847650174113791923797261341759",
                "174702926658126841229006764848148191096",
                "285548623309379140956462594847965898034",
                "49855895862318171065648960312803485848",
                "104994694647776227251747011768905927709",
                "6779959532214371828225208717880741968",
                "221267716087065188218725064356618818099",
                "277334954013557783242122067576758980425",
                "127931839055524378315408783798144474970",
                "40641952937869006545492645599143310233",
                "148158130499221419752834862069973587129",
                "87819578434253566267272185651247222152",
                "240622602603374510796905344920722298368",
                "99992578413186169226735216879355836352",
                "36319406282889696794209181696040869127",
                "22644804770329743107517395777353236325",
                "267266775572531934539436278735158572225",
                "74551928255256161757107381706560322281",
                "164920517632128951182373986886750058415",
                "35543584844430583818555093035288750744",
                "9562807583165632494507531230133546920",
                "39166070765083683408848459641049292663",
                "274450183716863677251786186380597750951",
                "224990284865345248672772138424631456433",
                "171872121939947935968431160379188910857",
                "191645551556644993591645221290690478786",
                "69032822509006505870280062337023881310",
                "246095451335979716646128747335448775439",
                "151510232770011198534705437699164516393",
                "16895367694114151147756485951983966043",
                "318175227882801580340823583660214675322"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2022-29184-dfd63cfc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb",
        "target": {
            "file": "domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java"
        }
    }
]