GHSA-m8r4-c7jm-w782

Suggest an improvement
Source
https://github.com/advisories/GHSA-m8r4-c7jm-w782
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m8r4-c7jm-w782/GHSA-m8r4-c7jm-w782.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m8r4-c7jm-w782
Aliases
Published
2022-05-24T17:35:09Z
Modified
2024-02-16T08:15:18.054455Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Jenkins Plugin Installation Manager Tool did not verify plugin downloads
Details

Jenkins Plugin Installation Manager Tool is part of the Jenkins project Docker images. As jenkins-plugin-cli it is used to download and install plugins even before Jenkins is running.

Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. This may allow third parties such as mirror operators to provide crafted plugin downloads.

Jenkins Plugin Installation Manager Tool 2.2.0 confirms that actual checksums of downloaded plugin match the expected checksums.

Docker images of Jenkins 2.269 and 2.263.1 contain Plugin Installation Manager Tool 2.2.0. Users of older Docker images can change the version they use by extending the Jenkins image and update the tool themselves with:

ARG PLUGINCLIURL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.2.0/jenkins-plugin-manager-2.2.0.jar RUN curl -fsSL ${PLUGINCLIURL} -o /usr/lib/jenkins-plugin-manager.jar Jenkinsfile Runner 1.0-beta-22 Docker images also include Plugin Installation Manager Tool 2.2.0.

Database specific 
{
    "nvd_published_at": "2020-12-03T16:15:00Z",
    "cwe_ids": [
        "CWE-494"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-07T23:54:44Z"
}
References

Affected packages

Maven / io.jenkins.plugin-management:plugin-management-parent-pom

Package

Name
io.jenkins.plugin-management:plugin-management-parent-pom
View open source insights on deps.dev
Purl
pkg:maven/io.jenkins.plugin-management/plugin-management-parent-pom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.0

Affected versions

0.*

0.1-alpha-10
0.1-alpha-11
0.1-alpha-12
0.1-alpha-13
0.1-alpha-14
0.1-alpha-15

1.*

1.0
1.0.1
1.0.2
1.1.0
1.1.2
1.2.0

2.*

2.0.0-beta-1
2.0.0
2.0.1
2.1.0
2.1.1
2.1.2
2.1.3