CVE-2022-29047: Vulnerability in org.jenkins-ci.plugins.workflow:workflow-cps-global-lib
Summary
CVE-2022-29047: Multibranch Pipelines by default limit who can change the Pipeline definition from the Jenkinsfile. Affects org.jenkins-ci.plugins.workflow:workflow-cps-global-lib across 2 version ranges.
< 2.21.3
>= 544.vff04fa68714d, < 566.vd0a
Fixed in 2.21.3 or 566.vd0a, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The org.jenkins-ci.plugins.workflow:workflow-cps-global-lib package is a Maven package used in Jenkins for managing global libraries in pipeline workflows. These global libraries provide reusable code and functions that can be used across multiple pipelines. The package allows users to define and use libraries in their Jenkinsfile to extend the functionality of their pipelines.
Vulnerability Detail
The vulnerability (CVE-2022-29047) in org.jenkins-ci.plugins.workflow:workflow-cps-global-lib allows untrusted users to modify some Pipeline libraries in Jenkins Pipeline: Deprecated Groovy Libraries Plugin. By default, Multibranch Pipelines limit who can change the Pipeline definition from the Jenkinsfile, ensuring that only trusted users can modify the pipeline behavior. However, this protection does not apply to the library step with a retriever argument pointing to a library in the current build's repository and branch. This allows attackers who can submit pull requests but cannot directly commit to the SCM to effectively change the Pipeline behavior by modifying the library behavior in their pull request.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.21.32.21.3 -
>= 544.vff04fa68714d, < 566.vd0a566.vd0a
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the Pipeline: Deprecated Groovy Libraries Plugin.
Conclusion
The vulnerability in org.jenkins-ci.plugins.workflow:workflow-cps-global-lib allows untrusted users to modify Pipeline libraries, potentially leading to unauthorized code execution or privilege escalation. It is crucial to upgrade to the fixed version of the Pipeline: Deprecated Groovy Libraries Plugin (2.21.3 or later) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib →
FAQ
The vulnerability allows untrusted users to modify the behavior of Pipeline libraries in Jenkins, potentially leading to unauthorized code execution or privilege escalation.
Users of Jenkins with the Pipeline: Deprecated Groovy Libraries Plugin version 564.ve62a and earlier are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment.
Yes, upgrading to Pipeline: Deprecated Groovy Libraries Plugin version 2.21.3 or later fixes this vulnerability.
No, changing Jenkins configuration does not mitigate this vulnerability. Upgrading to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
